A flaw was found in the OpenShift Cluster Logging Operator. The operator creates kubernetes.io/service-account-token Secrets and forwards them as bearer authentication to output URLs without verifying that the ClusterLogForwarder creator has authorization to use the referenced ServiceAccount's credentials. A user with write access to ClusterLogForwarder resources but without secrets access can exfiltrate ServiceAccount tokens for any in-namespace ServiceAccount. When a CLF specifies only receiver-type inputs, the SubjectAccessReview validation is bypassed entirely, widening the attack to SAs without log-collection RBAC. However, even with standard inputs, any SA that passes the input-side SAR check (including the operator's own SA) has its token created and forwarded without output-side authorization. The stolen token inherits all RBAC bindings of the target ServiceAccount, potentially enabling cluster-wide privilege escalation.

A flaw was found in the Pen Drive tool's HTML report generation. When Pen Drive runs a full-run against an OpenShift cluster or a must-gather archive, it generates an HTML report containing cluster data. Cluster-sourced fields — including the ClusterVersion spec.channel, CatalogSource metadata, and Subscription configuration — are rendered directly into the HTML output without escaping or sanitization. An attacker with cluster administrator privileges (or the ability to modify a must-gather archive) can inject arbitrary HTML and JavaScript into cluster objects using commands such as: oc patch clusterversion version --type merge -p '{"spec":{"channel":"stable-4.18<img src=x onerror=alert(1)>"}}'. When Pen Drive generates a report from this cluster data and another user (such as a support engineer or cluster administrator) opens the report in their browser, the injected JavaScript executes in their browser context. This can lead to session token theft, credential exfiltration, or manipulation of displayed content. The vulnerability was found during an internal pentest of Pen Drive version 0.1.3 and is reportedly fixed in version 1.0.0-2.

The DevWorkspace Operator extends OpenShift to provide DevWorkspace support. Security Fix(es): libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat (CVE-2024-8176)

Description: When verifying the iss field, telemeter uses strings.Split(tokenData, ".") to extract the payload, which means that the user should submit a Compact type JWS Token. However, go-jose's jwt.ParseSigned(tokenData) also supports authenticating JWS Token of JSON type. That means if the attacker submits a Token like:

{ "fakeiss":".eyJpc3MiOiJhY2NvdW50cy5nb29nbGUuY29tIn0.", "protected":"", "header":"", "payload":"", "signature":"" }

The attacker can forge a token issued by Google to pass the verification(for example). If two server use the same pair of key, the attacker can use the token from the first server to deceive the second server, and cause the privilege escape. The original reporter has raised this issue to Kubernetes, and they have fixed this problem: https://github.com/kubernetes/kubernetes/pull/123540

---

https://github.com/openshift/telemeter Version: 4.17 Related Code: https://github.com/openshift/telemeter/blob/a9417a6062c3a31ed78c06ea3a0613a52f2029b2/pkg/authorize/jwt/clientauthorizer.go#L78

The opa-openshift component is responsible for authorizing the requests going to the LokiStack through the gateway. Requests are authenticated using a token and authorization happens by, among other things, checking for an RBAC privilege. To reduce the number of SubjectAccessReviews the result of the authorization is cached in opa-openshift for a while. Currently, the key used for this caching is just the token, which is too broad and allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.

Bombastic allows authenticated users to upload compressed (bzip2 or zstd) SBOMs. The API endpoint verifies the presence of some fields and values in the JSON, to perform this verification the uploaded file must first be decompressed.

The decompression of malicious bzip2-compressed JSON can cause memory exhaustion: a 69 Kb bzip2 compressed file can be uncompressed to the order of 100 Gb. This causes the pod to become unresponsive and quickly leads to its eviction by OpenShift. A new pod is then re-deployed in lieu of the evicted one.

Note: malicious JSON compressed with zstd do not seem to be affected by this attack.

openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive private key information by reading the systemd journal.

In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.

https://vuldb.com/?id.216987 https://github.com/openshift/osin/commit/8612686d6dda34ae9ef6b5a974e4b7accb4fea29 https://github.com/openshift/osin/pull/200 https://vuldb.com/?ctiid.216987

Michael Scherer (mscherer) reports:

the file https://github.com/openshift/origin-server/blob/master/node-util/www/html/restorer.php used to restore application after being idle fails to safely handle user supplied data that is later used on the command line.

Network Observability 1.2.0 is an OpenShift operator that provides a monitoring pipeline to collect and enrich network flows that are produced by the Network observability eBPF agent.The operator provides dashboards, metrics, and keeps flows accessible in aqueryable log store, Grafana Loki. When a FlowCollector is deployed, newdashboards are available in the Console.This update contains bug fixes.Security Fix(es): golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717) golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724) golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Kubernetes api server: build config to a strategy that isn't allowed by policy

External reference: https://github.com/openshift/origin/issues/6556 https://github.com/openshift/origin/pull/6576

OpenShift API for Data Protection (OADP) enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and snapshot-based backups for persistent volumes.Security Fix(es) from Bugzilla: golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191) golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664) golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632) golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635) golang: net/url: JoinPath does not strip relative path components in all circumstances (CVE-2022-32190) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

It has been found that multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/mediawiki-container.

Original bug: https://bugzilla.redhat.com/showbug.cgi?id=1791534

Openshift Logging Bug Fix Release (5.3.10)<br>Security Fix(es):<br><li> golang: out-of-bounds read in golang.org/x/text/language leads to DoS (CVE-2021-38561)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat Single Sign-On is an integrated sign-on solution, available as a<br>Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat<br>Single Sign-On for OpenShift image provides an authentication server that<br>you can use to log in centrally, log out, and register. You can also manage<br>user accounts for web applications, mobile applications, and RESTful web<br>services.<br>This erratum releases a new image for Red Hat Single Sign-On 7.4.10 for<br>use within the OpenShift Container Platform 3.10, OpenShift Container Platform<br>3.11, and within the OpenShift Container Platform 4.3 cloud computing Platform-as-a-Service (PaaS) for<br>on-premise or private cloud deployments, aligning with the standalone product release.<br>Security Fix(es):<br><li> undertow: client side invocation timeout raised when calling over HTTP and</li> HTTP2 (CVE-2021-3859)<br>For more details about the security issue(s), including the impact, a CVSS<br>score, and other related information, refer to the CVE page(s) listed in the<br>References section.

Openshift Logging Bug Fix Release (5.3.0)Security Fix(es): golang: x/net/html: infinite loop in ParseFragment (CVE-2021-33194) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

It has been found that multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/presto-container.

Original bug: https://bugzilla.redhat.com/showbug.cgi?id=1791534

It has been found that multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/mediawiki-apb

Original bug: https://bugzilla.redhat.com/showbug.cgi?id=1791534

Red Hat OpenShift Container Platform is Red Hat's cloud computing<br>Kubernetes application platform solution designed for on-premise or private<br>cloud deployments.<br>Security Fix(es):<br><li> golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Container Platform is Red Hat's cloud computingKubernetes application platform solution designed for on-premise or privatecloud deployments.Security Fix(es): openshift/mediawiki-apb: /etc/passwd is given incorrect privileges (CVE-2019-19345) openshift/mariadb-apb: /etc/passwd is given incorrect privileges (CVE-2019-19346) openshift/apb-base: /etc/passwd is given incorrect privileges (CVE-2019-19348) openshift/postgresql-apb: /etc/passwd is given incorrect privileges (CVE-2020-1707) openshift/mysql-apb: /etc/passwd is given incorrect privileges (CVE-2020-1708) openshift/mediawiki: /etc/passwd is given incorrect privileges (CVE-2020-1709) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat OpenShift Container Platform is Red Hat's cloud computingKubernetes application platform solution designed for on-premise or privatecloud deployments.Security Fix(es): openshift/mediawiki-apb: /etc/passwd is given incorrect privileges (CVE-2019-19345) openshift/mariadb-apb: /etc/passwd is given incorrect privileges (CVE-2019-19346) openshift/apb-base: /etc/passwd is given incorrect privileges (CVE-2019-19348) openshift/postgresql-apb: /etc/passwd is given incorrect privileges (CVE-2020-1707) openshift/mysql-apb: /etc/passwd is given incorrect privileges (CVE-2020-1708) For more details about the security issue(s), including the impact, a CVSSscore, acknowledgments, and other related information, refer to the CVEpage(s) listed in the References section.