SB2023020869 - Multiple vulnerabilities in OpenShift Container Platform 4.12

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023020869

SB2023020869 - Multiple vulnerabilities in OpenShift Container Platform 4.12

Published: February 8, 2023

Security Bulletin ID SB2023020869
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Resource exhaustion (CVE-ID: CVE-2021-4235)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when parsing YAML files. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.


2) Insufficient Entropy (CVE-ID: CVE-2021-4238)

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient entropy when generating alphanumeric strings within RandomAlphaNumeric and CryptoRandomAlphaNumeric functions, which always return strings containing at least one digit from 0 to 9. A remote attacker can launch brute-force attacks and gain access to sensitive information.


Remediation

Install update from vendor's website.

References