A flaw was found in OpenShift Container Platform. Completed pods with restartPolicy: Never do not count toward ResourceQuota pod limits, and Kubernetes events are not quota-scoped. A non-privileged user who can create pods in a namespace can exploit this to generate a large volume of events that accumulate in etcd, causing API server performance degradation across the cluster.

A flaw was found in the OpenShift Container Platform build system. A user with the edit ClusterRole can inject arbitrary environment variables, such as LDPRELOAD or httpproxy, into docker-build containers through the buildconfigs/instantiate API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.

A vulnerability in the OpenShift Container Platform allows an attacker with developer access to modify the config.json file on a worker node. By exploiting the build process and using a misconfigured pod that mounts /var/lib/kubelet/config.json without read-only restrictions, the attacker can overwrite the credentials file required for pulling container images. This leads to a denial of service, preventing the node from fetching images and potentially leaking sensitive credentials used to access private image repositories.

Moderate: OpenShift Container Platform 4.17.52 bug fix and security update

Moderate: OpenShift Container Platform 4.18.36 bug fix and security update

A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithUser() middleware function. Contrary to its name, this middleware function does not verify the validity of the user's credentials. As a result, unauthenticated users can access this endpoint.

A flaw was found in Red Hat's AMQ Broker, which stores certain passwords in a secret security-properties-prop-module, defined in ActivemqArtemisSecurity CR; however, they are shown in plaintext in the StatefulSet details yaml of AMQ Broker.

A denial of service (DoS) vulnerability was found in OpenShift. This flaw allows attackers to exploit the GraphQL batching functionality. The vulnerability arises when multiple queries can be sent within a single request, enabling an attacker to submit a request containing thousands of aliases in one query. This issue causes excessive resource consumption, leading to application unavailability for legitimate users.

Moderate: OpenShift Container Platform 4.17.30 bug fix and security update

Moderate: OpenShift Container Platform 4.17.29 bug fix and security update

Moderate: OpenShift Container Platform 4.18.13 bug fix and security update

The Tempo Operator in OpenShift Distributed Tracing creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic instance. This design allows any user with full access to their namespace to retrieve the associated ServiceAccount token and utilize it to make privileged API calls to:

Validate bearer tokens using the TokenReview API.

Check user permissions using the SubjectAccessReview API.

Moderate: OpenShift Container Platform 4.17.22 packages and security update

Moderate: OpenShift Container Platform 4.18.6 packages and security update

An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. This issue could allow an authenticated remote attacker to run a specially crafted malicious server in an OpenShift cluster. The biggest impact is to availability.

A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.

Moderate: OpenShift Container Platform 4.17.16 security update

Moderate: OpenShift Container Platform 4.17.15 bug fix and security update

Moderate: OpenShift Container Platform 4.15.44 security update

Moderate: OpenShift Container Platform 4.14.44 bug fix and security update

Moderate: OpenShift Container Platform 4.15.42 bug fix and security update

Moderate: OpenShift Container Platform 4.16.26 bug fix and security update

Moderate: OpenShift Container Platform 4.17.7 security and extras update

Moderate: OpenShift Container Platform 4.16.24 security update

A flaw was found in the Linux kernel where an unprivileged console user can crash kernel via a nouveau ioctl.

Reference: https://lists.freedesktop.org/archives/nouveau/2020-August/036682.html

Withdrawn Advisory

This advisory has been withdrawn because the vulnerability does not affect a package in one of the GitHub Advisory Database's supported ecosystems. This link is maintained to preserve external references.

Original Description

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.

Withdrawn Advisory This advisory has been withdrawn because the vulnerability does not apply to the Prometheus golang package. This link is maintained to preserve external references.

Original Description A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.

Moderate: OpenShift Container Platform 4.16.23 bug fix and security update

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

Moderate: OpenShift Container Platform 4.17.5 security update