SB2022062728 - Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022062728

SB2022062728 - Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes (RHACS)

Published: June 27, 2022

Security Bulletin ID SB2022062728
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper access control (CVE-ID: CVE-2022-1902)

The vulnerability allows a remote user to gain unauthorized access to sensitive information.

The vulnerability exists due to improper access restrictions to the Notifier secrets. A remote authenticated user retrieve Notifiers from the GraphQL API, obtain secrets and escalate privileges within the application.


2) Input validation error (CVE-ID: CVE-2022-1271)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to insufficient validation when processing filenames with two or more newlines. A remote attacker can force zgrep or xzgrep to write arbitrary files on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.


Remediation

Install update from vendor's website.

References