A flaw was found in kubevirt 0.29 and earlier. Virtual Machine Instances (VMIs) can be used to gain access to the host's filesystem. Successful exploitation allows an attacker to assume the privileges of the VM process on the host system. In worst-case scenarios an attacker can read and modify any file on the system where the VMI is running. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
Important: OpenShift Virtualization 4.12.9 Images security and bug fix update
Important: OpenShift Virtualization 4.13.9 Images security update
Important: OpenShift Virtualization 4.17.3 Images
Important: OpenShift Virtualization 4.15.9 Images
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.This advisory contains OpenShift Virtualization v4.19 images.
Important: OpenShift Virtualization 4.13.3 Images security and bug fix update
Withdrawn Advisory This advisory has been withdrawn. This link is maintained to preserve external references.
Original Description An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Versions before kubernetes-nmstate-handler-container-v2.3.0-30 are affected.
Important: OpenShift Virtualization 4.13.6 security and bug fix update
Important: OpenShift Virtualization 4.13.6 RPMs security and bug fix update
Moderate: OpenShift Virtualization 4.14.6 Images security update
Moderate: OpenShift Virtualization 4.13.0 Images security, bug fix, and enhancement update
Moderate: OpenShift Virtualization 4.12.6 Images
Moderate: OpenShift Virtualization 4.13.11 Images
Moderate: OpenShift Virtualization 4.12.15 Images
Low: OpenShift Virtualization 4.15.5 Images
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.This advisory contains OpenShift Virtualization 4.15.2 images.Security Fix(es): golang: net/http, x/net/http2: unlimited number of CONTINUATION frames causes DoS (CVE-2023-45288) follow-redirects: Improper Input Validation due to the improper handling of URLs by the url.parse() (CVE-2023-26159) axios: exposure of confidential data stored in cookies (CVE-2023-45857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.This advisory contains OpenShift Virtualization 4.12.12 images.Security Fix(es): axios: exposure of confidential data stored in cookies (CVE-2023-45857) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.<br>This advisory contains OpenShift Virtualization 4.15.3 images.<br>Security Fix(es):<br><li> ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.This advisory contains OpenShift Virtualization 4.16.0 images.Security Fix(es): axios: exposure of confidential data stored in cookies (CVE-2023-45857) golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) jose-go: improper handling of highly compressed data (CVE-2024-28180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.This advisory contains OpenShift Virtualization 4.16.1 images.Security Fix(es): fast-xml-parser: ReDOS at currency parsing in currency.js (CVE-2024-41818) golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.This advisory contains OpenShift Virtualization 4.13.10 images.Security Fix(es): axios: exposure of confidential data stored in cookies (CVE-2023-45857) For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.<br>This advisory contains OpenShift Virtualization 4.18.0 images.<br>Security Fix(es):<br><li> golang.org/x/net/html: Non-linear parsing of case-insensitive content in</li> golang.org/x/net/html (CVE-2024-45338)
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.This advisory contains OpenShift Virtualization 4.18.25 images.
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.This advisory contains OpenShift Virtualization 4.20.3 images.
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.This advisory contains OpenShift Virtualization v4.15 images.
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.This advisory contains OpenShift Virtualization v4.13 images.
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.This advisory contains OpenShift Virtualization v4.15 images.
OpenShift Virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.This advisory contains OpenShift Virtualization 4.14.16 images.