Critical: Multicluster Global Hub 1.4.8 security update

Critical: Multicluster Global Hub 1.5.7 security update

Critical: Multicluster Global Hub 1.6.5 security update

OpenShift Container Platform 4.16.68 bug fix and security update

A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects.

A flaw was found in the multicloud-integrations component of Red Hat Advanced Cluster Management (RHACM). The Application propagation controller takes the tenant-controlled ocm-managed-cluster annotation verbatim from an Application CR and uses it as the ManifestWork namespace without authorization checks. The only validation is a bare existence check on the target ManagedCluster. A tenant with Application create permissions in any hub namespace can generate ManifestWorks targeting arbitrary managed clusters, resulting in spoke cluster-admin ArgoCD syncing attacker-controlled manifests.

Upstream repo: https://github.com/stolostron/multicloud-integrations Audited commit: d88a168 Jira tracker: ACM-38643

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). The application-manager addon's ClusterRole grants apiGroups: resources: verbs: (plus nonResourceURLs:) and is bound to the application-manager ServiceAccount on every managed cluster via the addon framework. This wildcard RBAC is the root enabler for multiple confused-deputy attacks where a namespace-admin tenant can create Subscription CRs that deploy arbitrary cluster-scoped resources using this privileged SA. A least-privilege variant exists in addon/manifests/permission/role.yaml but is not used by default.

Upstream repo: https://github.com/stolostron/multicloud-operators-subscription Audited commit: 48ae4defaa5b719e0664e1de7413c96029c938bc Jira tracker: ACM-38624

Release of RHOAI 3.3.6 provides these changes:

Release of RHOAI 3.4.3 provides these changes:

Release of RHOAI 2.25.10 provides these changes:

Critical: Multicluster Global Hub 1.7.2 security update

Critical: Multicluster Global Hub 1.8.1 security update

OpenShift Container Platform 4.17.56 bug fix and security update

OpenShift Container Platform 4.19.41 bug fix and security update

OpenShift Container Platform 4.18.51 bug fix and security update

OpenShift Container Platform 4.22.8 bug fix and security update

OpenShift Container Platform 4.20.32 bug fix and security update

OpenShift Container Platform 4.21.27 bug fix and security update

Critical: perl-GD security update

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can authenticate to the exposed WildFly management console on port 20990 and deploy a malicious Web Application Archive file through the Deployments interface to achieve remote code execution as the Windows machine account. Version 14.x.x was declared end-of-life (EOL) in 2017 and future releases have addressed the vulnerable finding.

Critical: multicluster engine for Kubernetes v2.8.9 security update

Critical: multicluster engine for Kubernetes v2.9.6 security update

Critical: multicluster engine for Kubernetes v2.6.13 security update

Critical: multicluster engine for Kubernetes v2.11.4 security update

Critical: multicluster engine for Kubernetes v2.17.1 security update

Critical: OpenShift Container Platform 4.22.7 bug fix and security update

Critical: multicluster engine for Kubernetes v2.10.4 security update

Critical: multicluster engine for Kubernetes v2.10.4 security update

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.

Migration Toolkit for Applications