Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.10



Published: 2023-04-12 | Updated: 2024-01-19
Risk High
Patch available YES
Number of vulnerabilities 9
CVE-ID CVE-2022-3172
CVE-2022-31690
CVE-2022-31692
CVE-2022-42889
CVE-2023-24422
CVE-2023-27898
CVE-2023-27899
CVE-2023-27903
CVE-2023-27904
CWE-ID CWE-918
CWE-264
CWE-285
CWE-94
CWE-79
CWE-276
CWE-200
Exploitation vector Network
Public exploit Public exploit code for vulnerability #4 is available.
Vulnerable software
Subscribe 		Red Hat OpenShift Container Platform
Client/Desktop applications / Software for system administration

toolbox (Red Hat package)
Operating systems & Components / Operating system package or component

openshift-clients (Red Hat package)
Operating systems & Components / Operating system package or component

openshift (Red Hat package)
Operating systems & Components / Operating system package or component

jenkins (Red Hat package)
Operating systems & Components / Operating system package or component

jenkins-2-plugins (Red Hat package)
Operating systems & Components / Operating system package or component

haproxy (Red Hat package)
Operating systems & Components / Operating system package or component

cri-o (Red Hat package)
Operating systems & Components / Operating system package or component

kernel-rt (Red Hat package)
Operating systems & Components / Operating system package or component

kernel (Red Hat package)
Operating systems & Components / Operating system package or component

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 9 vulnerabilities.

1) Server-Side Request Forgery (SSRF)

EUVDB-ID: #VU67554

Risk: Medium

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3172

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input in kube-apiserver. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.10 - 4.10.55

toolbox (Red Hat package): before 0.0.9-1.rhaos4.10.el8

openshift-clients (Red Hat package): before 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8

openshift (Red Hat package): before 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8

jenkins (Red Hat package): before 2.387.1.1680701869-1.el8

jenkins-2-plugins (Red Hat package): before 4.10.1680703106-1.el8

haproxy (Red Hat package): before 2.2.19-4.el8

cri-o (Red Hat package): before 1.23.5-8.rhaos4.10.gitcc8441d.el8

kernel-rt (Red Hat package): before 4.18.0-305.85.1.rt7.157.el8_4

kernel (Red Hat package): before 4.18.0-305.85.1.el8_4

External links

http://access.redhat.com/errata/RHSA-2023:1655


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU68865

Risk: Medium

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-31690

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in spring-security-oauth2-client. A remote user can modify a request initiated by the Client to the Authorization Server and gain elevated privileges on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.10 - 4.10.55

toolbox (Red Hat package): before 0.0.9-1.rhaos4.10.el8

openshift-clients (Red Hat package): before 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8

openshift (Red Hat package): before 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8

jenkins (Red Hat package): before 2.387.1.1680701869-1.el8

jenkins-2-plugins (Red Hat package): before 4.10.1680703106-1.el8

haproxy (Red Hat package): before 2.2.19-4.el8

cri-o (Red Hat package): before 1.23.5-8.rhaos4.10.gitcc8441d.el8

kernel-rt (Red Hat package): before 4.18.0-305.85.1.rt7.157.el8_4

kernel (Red Hat package): before 4.18.0-305.85.1.el8_4

External links

http://access.redhat.com/errata/RHSA-2023:1655


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Authorization

EUVDB-ID: #VU68866

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-31692

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to authorization rules bypass via forward or include dispatcher types. A remote attacker can bypass authorization process.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.10 - 4.10.55

toolbox (Red Hat package): before 0.0.9-1.rhaos4.10.el8

openshift-clients (Red Hat package): before 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8

openshift (Red Hat package): before 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8

jenkins (Red Hat package): before 2.387.1.1680701869-1.el8

jenkins-2-plugins (Red Hat package): before 4.10.1680703106-1.el8

haproxy (Red Hat package): before 2.2.19-4.el8

cri-o (Red Hat package): before 1.23.5-8.rhaos4.10.gitcc8441d.el8

kernel-rt (Red Hat package): before 4.18.0-305.85.1.rt7.157.el8_4

kernel (Red Hat package): before 4.18.0-305.85.1.el8_4

External links

http://access.redhat.com/errata/RHSA-2023:1655


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Code Injection

EUVDB-ID: #VU68307

Risk: High

CVSSv3.1: 9.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2022-42889

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an insecure variable interpolation when processing untrusted input. A remote attacker can send a specially crafted input and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability was dubbed Text4shell.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.10 - 4.10.55

toolbox (Red Hat package): before 0.0.9-1.rhaos4.10.el8

openshift-clients (Red Hat package): before 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8

openshift (Red Hat package): before 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8

jenkins (Red Hat package): before 2.387.1.1680701869-1.el8

jenkins-2-plugins (Red Hat package): before 4.10.1680703106-1.el8

haproxy (Red Hat package): before 2.2.19-4.el8

cri-o (Red Hat package): before 1.23.5-8.rhaos4.10.gitcc8441d.el8

kernel-rt (Red Hat package): before 4.18.0-305.85.1.rt7.157.el8_4

kernel (Red Hat package): before 4.18.0-305.85.1.el8_4

External links

http://access.redhat.com/errata/RHSA-2023:1655


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.

5) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU71499

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-24422

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to a sandbox bypass issue. A remote user can bypass the sandbox protection and execute arbitrary code in the context of the Jenkins controller JVM.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.10 - 4.10.55

toolbox (Red Hat package): before 0.0.9-1.rhaos4.10.el8

openshift-clients (Red Hat package): before 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8

openshift (Red Hat package): before 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8

jenkins (Red Hat package): before 2.387.1.1680701869-1.el8

jenkins-2-plugins (Red Hat package): before 4.10.1680703106-1.el8

haproxy (Red Hat package): before 2.2.19-4.el8

cri-o (Red Hat package): before 1.23.5-8.rhaos4.10.gitcc8441d.el8

kernel-rt (Red Hat package): before 4.18.0-305.85.1.rt7.157.el8_4

kernel (Red Hat package): before 4.18.0-305.85.1.el8_4

External links

http://access.redhat.com/errata/RHSA-2023:1655


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Stored cross-site scripting

EUVDB-ID: #VU73187

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-27898

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in plugin manager. A remote attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.10 - 4.10.55

toolbox (Red Hat package): before 0.0.9-1.rhaos4.10.el8

openshift-clients (Red Hat package): before 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8

openshift (Red Hat package): before 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8

jenkins (Red Hat package): before 2.387.1.1680701869-1.el8

jenkins-2-plugins (Red Hat package): before 4.10.1680703106-1.el8

haproxy (Red Hat package): before 2.2.19-4.el8

cri-o (Red Hat package): before 1.23.5-8.rhaos4.10.gitcc8441d.el8

kernel-rt (Red Hat package): before 4.18.0-305.85.1.rt7.157.el8_4

kernel (Red Hat package): before 4.18.0-305.85.1.el8_4

External links

http://access.redhat.com/errata/RHSA-2023:1655


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Code Injection

EUVDB-ID: #VU73188

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-27899

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to the affected plugin creates the temporary file in the system temporary directory with the default permissions for newly created files. A remote user can read and write the file before it is installed in Jenkins and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.10 - 4.10.55

toolbox (Red Hat package): before 0.0.9-1.rhaos4.10.el8

openshift-clients (Red Hat package): before 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8

openshift (Red Hat package): before 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8

jenkins (Red Hat package): before 2.387.1.1680701869-1.el8

jenkins-2-plugins (Red Hat package): before 4.10.1680703106-1.el8

haproxy (Red Hat package): before 2.2.19-4.el8

cri-o (Red Hat package): before 1.23.5-8.rhaos4.10.gitcc8441d.el8

kernel-rt (Red Hat package): before 4.18.0-305.85.1.rt7.157.el8_4

kernel (Red Hat package): before 4.18.0-305.85.1.el8_4

External links

http://access.redhat.com/errata/RHSA-2023:1655


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Incorrect default permissions

EUVDB-ID: #VU73196

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-27903

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to the affected plugin creates the temporary file in the default temporary directory with the default permissions for newly created files. A local user can read and write the file before it is used in the build.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.10 - 4.10.55

toolbox (Red Hat package): before 0.0.9-1.rhaos4.10.el8

openshift-clients (Red Hat package): before 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8

openshift (Red Hat package): before 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8

jenkins (Red Hat package): before 2.387.1.1680701869-1.el8

jenkins-2-plugins (Red Hat package): before 4.10.1680703106-1.el8

haproxy (Red Hat package): before 2.2.19-4.el8

cri-o (Red Hat package): before 1.23.5-8.rhaos4.10.gitcc8441d.el8

kernel-rt (Red Hat package): before 4.18.0-305.85.1.rt7.157.el8_4

kernel (Red Hat package): before 4.18.0-305.85.1.el8_4

External links

http://access.redhat.com/errata/RHSA-2023:1655


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Information disclosure

EUVDB-ID: #VU73197

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-27904

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application within error stack traces related to agents. A remote user can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 4.10 - 4.10.55

toolbox (Red Hat package): before 0.0.9-1.rhaos4.10.el8

openshift-clients (Red Hat package): before 4.10.0-202304032041.p0.g3a7500d.assembly.stream.el8

openshift (Red Hat package): before 4.10.0-202303221742.p0.g16bcd69.assembly.stream.el8

jenkins (Red Hat package): before 2.387.1.1680701869-1.el8

jenkins-2-plugins (Red Hat package): before 4.10.1680703106-1.el8

haproxy (Red Hat package): before 2.2.19-4.el8

cri-o (Red Hat package): before 1.23.5-8.rhaos4.10.gitcc8441d.el8

kernel-rt (Red Hat package): before 4.18.0-305.85.1.rt7.157.el8_4

kernel (Red Hat package): before 4.18.0-305.85.1.el8_4

External links

http://access.redhat.com/errata/RHSA-2023:1655


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###