Errata Advisory for Red Hat OpenShift GitOps v1.14.4 security release.Security Fix(es): openshift-gitops-argocd-container: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS) gitops-1.14 openshift-gitops-1/gitops-operator-bundle: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS) gitops-1.14 openshift-gitops-1/argocd-rhel9: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS) gitops-1.14 openshift-gitops-operator-container: Namespace Isolation Break gitops-1.14 openshift-gitops-dex-container: Unexpected memory consumption during token parsing in golang.org/x/oauth2 gitops-1.14 openshift-gitops-container: Potential denial of service in golang.org/x/crypto gitops-1.14 openshift-gitops-argo-rollouts-container: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS gitops-1.14 openshift-gitops-argocd-container: jwt-go allows excessive memory allocation during header parsing gitops-1.14 openshift-gitops-argocd-rhel9-container: jwt-go allows excessive memory allocation during header parsing gitops-1.14 openshift-gitops-argocd-container: Prototype Pollution in redoc gitops-1.14 openshift-gitops-argocd-rhel9-container: Prototype Pollution in redoc gitops-1.14

Errata Advisory for Red Hat OpenShift GitOps v1.14.3.<br>Security Fix(es):<br><li> openshift-gitops-argocd-rhel9-container: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto gitops-1.14</li> <li> openshift-gitops-container: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto gitops-1.14</li> <li> openshift-gitops-argocd-rhel9-container: Argo CD does not scrub secret values from patch errors gitops-1.14</li> <li> openshift-gitops-container: Argo CD does not scrub secret values from patch errors gitops-1.14</li> <li> openshift-gitops-operator-bundle-container: Argo CD does not scrub secret values from patch errors gitops-1.14</li> <li> openshift-gitops-operator-container: Argo CD does not scrub secret values from patch errors gitops-1.14</li> <li> openshift-gitops-container: Argo CD does not scrub secret values from patch errors gitops-1.14</li> <li> openshift-gitops-console-plugin-container: Improper input validation in PostCSS gitops-1.14</li> <li> openshift-gitops-argo-rollouts-container: Non-linear parsing of case-insensitive content in golang.org/x/net/html gitops-1.14</li> <li> openshift-gitops-argocd-container: Non-linear parsing of case-insensitive content in golang.org/x/net/html gitops-1.14</li> <li> openshift-gitops-argocd-rhel9-container: Non-linear parsing of case-insensitive content in golang.org/x/net/html gitops-1.14</li> <li> openshift-gitops-dex-container: Non-linear parsing of case-insensitive content in golang.org/x/net/html gitops-1.14</li> <li> openshift-gitops-argocd-container: argument injection via the URL field gitops-1.14</li> <li> openshift-gitops-argocd-rhel9-container: go-git clients vulnerable to DoS via maliciously crafted Git server replies gitops-1.14</li> <li> openshift-gitops-argocd-container: go-git clients vulnerable to DoS via maliciously crafted Git server replies gitops-1.14</li> <li> openshift-gitops-container: go-git clients vulnerable to DoS via maliciously crafted Git server replies gitops-1.14</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RErrata Advisory for Red Hat OpenShift GitOps v1.10.2.<br>Security Fix(es):<br><li> argo-cd: vulnerable to a cross-server request forgery (CSRF)</li> attack (CVE-2024-22424)<br><li> go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients (CVE-2023-49569)</li> <li> go-git: Maliciously crafted Git server replies can cause DoS on go-git clients (CVE-2023-49568)</li> For more details about the security issue(s), including the impact, a CVSS<br>score, acknowledgments, and other related information, refer to the CVE page(s)<br>listed in the References section.

Errata Advisory for Red Hat OpenShift GitOps v1.9.4.Security Fix(es): TRIAGE CVE-2024-22424 openshift-gitops-operator-container: argo-cd: vulnerable to a cross-server request forgery (CSRF) attack [gitops-1.9] CVE-2023-49568 openshift-gitops-container: go-git: Maliciously crafted Git server replies can cause DoS on go-git clients [gitops-1.9] CVE-2023-49569 openshift-gitops-container: go-git: Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients [gitops-1.9] CVE-2023-49568 openshift-gitops-argocd-container: go-git: Maliciously crafted Git server replies can cause DoS on go-git clients [gitops-1.9] For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVE page(s)listed in the References section.

Errata Advisory for Red Hat OpenShift GitOps v1.11.1.<br>Security Fix(es):<br><li> argo-cd: vulnerable to a cross-server request forgery (CSRF) attack (CVE-2024-22424)</li> For more details about the security issue(s), including the impact, a CVSS<br>score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.<br>Security Fix(es):<br><li> golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)</li> <li> HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift GitOps 1.10.<br>Security Fix(es):<br><li> golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The opa-openshift component is responsible for authorizing the requests going to the LokiStack through the gateway. Requests are authenticated using a token and authorization happens by, among other things, checking for an RBAC privilege. To reduce the number of SubjectAccessReviews the result of the authorization is cached in opa-openshift for a while. Currently, the key used for this caching is just the token, which is too broad and allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.

Security Fix(es): goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be (CVE-2021-4238) go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064) ArgoCD: Users with any cluster secret update access may update out-of-bounds cluster secrets (CVE-2023-23947) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security Fix(es): goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be (CVE-2021-4238) go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064) ArgoCD: Users with any cluster secret update access may update out-of-bounds cluster secrets (CVE-2023-23947) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Security Fix(es): goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be (CVE-2021-4238) go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064) ArgoCD: Users with any cluster secret update access may update out-of-bounds cluster secrets (CVE-2023-23947) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Jordan Liggitt of Atomic OpenShift reports:

UPSTREAM: 17886: pod log location must validate container if provided #6113 has security implications, specifically a running pod could make an API call to view the logs of any pod running on the same Node.

External references:

https://github.com/openshift/origin/pull/6113

Jeremy Choi of Red Hat reports:

Attackers, with normal user privilege, are able to do OS command injection with root by leveraging a downloadable cartridge where its source-URL scheme is 'file'.

In cartridgerepository.rb:

532 when 'file' == uri.scheme 533 entries = Dir.glob(PathUtils.join(uri.path, ''), File::FNMDO TMATCH) 534 filesystemcopy(entries, target, %w(. ..)) ... 609 Utils.oospawn("/bin/cp -ad #{entries.join(' ')} #{target}", 610 expectedexitstatus: 0)

OpenShift Origin copies the directory structure from the user specified cartridge when an application is created via 'file' scheme source. Due to this attackers are able to add an arbitrary directory with system commands (e.g. ;reboot;) in their apps and put it to cp, resulting in OS command injection attack with root privileges.