REDHAT-BUG-2072188: Low severity Red Hat OpenShift vulnerability
The ability to specify a custom host name is governed by the "custom-host" permission, which is granted by default to all project administrators[1]. It is possible for the cluster administrator to revoke this permission. Then, the OpenShift API admission checks should prohibit project administrators from setting a custom host name on ingress and route objects. The problem is that the admission checks do not enforce this prohibition for ingress objects under some circumstances.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2072188?
The severity of REDHAT-BUG-2072188 is considered to be high due to the potential security implications of UID-based permissions.
How do I fix REDHAT-BUG-2072188?
To fix REDHAT-BUG-2072188, revoke the "custom-host" permission from project administrators if it has been granted.
Who is affected by REDHAT-BUG-2072188?
Red Hat OpenShift project administrators are affected by REDHAT-BUG-2072188 if they have been granted the "custom-host" permission.
What does REDHAT-BUG-2072188 expose?
REDHAT-BUG-2072188 exposes a security vulnerability related to project administrator permissions regarding custom host names.
Can cluster administrators manage REDHAT-BUG-2072188?
Yes, cluster administrators can manage REDHAT-BUG-2072188 by revoking the "custom-host" permission from project administrators.