REDHAT-BUG-2512148: High severity stolostron/search-v2-api vulnerability
Cache.tokenReviews is a map[string]tokenReviewCache keyed by the raw bearer token string (tokenReview.go:39). On every distinct token -- valid or not -- GetTokenReview inserts a new entry before the API call and never deletes it. StartBackgroundValidation watches Namespaces and ManagedClusters but has only TODO comments for token cache cleanup. An unauthenticated attacker can exhaust the search-api pod's memory by sending requests with unique random bearer tokens, each of which creates a permanent cache entry.
Upstream: stolostron/search-v2-api
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2512148?
The severity of REDHAT-BUG-2512148 is high, rated at 7.
What is the risk associated with REDHAT-BUG-2512148?
The risk associated with REDHAT-BUG-2512148 is classified as 33.
How can I address the issue described in REDHAT-BUG-2512148?
To address REDHAT-BUG-2512148, it is recommended to implement a cleanup mechanism to manage entries in the Cache.tokenReviews map.
What problem does REDHAT-BUG-2512148 highlight in the token review process?
REDHAT-BUG-2512148 highlights that the GetTokenReview function inserts new entries for each distinct token without deleting them, potentially leading to resource exhaustion.
Which software is affected by REDHAT-BUG-2512148?
The software affected by REDHAT-BUG-2512148 is stolostron/search-v2-api.