CVE-2024-7079: Openshift-console: unauthenticated installation of helm charts
First published: Wed Jul 24 2024(Updated: )
A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithUser() middleware function. Contrary to its name, this middleware function does not verify the validity of the user's credentials. As a result, unauthenticated users can access this endpoint.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat OpenShift Container Platform | =3.11 | |
| Red Hat OpenShift Container Platform | =4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-7079?
CVE-2024-7079 has been classified with a high severity rating due to its impact on the OpenShift console's Helm chart verification endpoint.
How do I fix CVE-2024-7079?
To mitigate CVE-2024-7079, it is recommended to update to the latest patched versions of Red Hat OpenShift Container Platform 3.11 and 4.0.
Which versions of OpenShift Container Platform are affected by CVE-2024-7079?
CVE-2024-7079 affects Red Hat OpenShift Container Platform versions 3.11 and 4.0.
What is the impact of exploiting CVE-2024-7079?
Exploitation of CVE-2024-7079 may allow unauthorized access to the Helm chart verification process, potentially compromising the integrity of the deployment.
Is there a known workaround for CVE-2024-7079?
Currently, there are no documented workarounds for CVE-2024-7079; the recommended approach is to apply the security updates.
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2024-7079
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/redhat
- canonical/red hat openshift container platform
- version/red hat openshift container platform/3.11
- version/red hat openshift container platform/4.0