REDHAT-BUG-2308673: Medium severity Red Hat OpenShift Container Platform vulnerability
A vulnerability in the OpenShift Container Platform allows an attacker with developer access to modify the config.json file on a worker node. By exploiting the build process and using a misconfigured pod that mounts /var/lib/kubelet/config.json without read-only restrictions, the attacker can overwrite the credentials file required for pulling container images. This leads to a denial of service, preventing the node from fetching images and potentially leaking sensitive credentials used to access private image repositories.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2308673?
The severity of REDHAT-BUG-2308673 is considered high due to the potential for an attacker to modify critical configuration files on worker nodes.
How do I fix REDHAT-BUG-2308673?
To fix REDHAT-BUG-2308673, ensure that pods mounting the config.json file are configured with read-only access and review user permissions carefully.
What systems are affected by REDHAT-BUG-2308673?
REDHAT-BUG-2308673 affects the Red Hat OpenShift Container Platform when configured with developer access that allows modification of the config.json file.
What are the potential impacts of REDHAT-BUG-2308673?
The potential impacts of REDHAT-BUG-2308673 include unauthorized modification of application configurations and possible escalation of privileges within the cluster.
Is there a workaround for REDHAT-BUG-2308673?
A workaround for REDHAT-BUG-2308673 is to restrict developer access and implement strict pod security policies to prevent unauthorized access to the config.json file.