multicluster engine for Kubernetes 2.11 vulnerabilities
34 known vulnerabilities in multicluster engine for Kubernetes 2.11 from Red Hat. 34 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.7 High severity
multicluster engine for Kubernetes 2.10: Client-Side Enforcement of Server-Side Security
A flaw was found in the clusterclaims-controller component of multicluster engine (MCE). A tenant with standard permissions to create and delete ClusterClaim resources can exploit this by manipulating the `spec.namespace` field. This allows the tenant to speci
- 7.7 High severity
multicluster engine for Kubernetes 2.10: Reliance on Insufficiently Trustworthy Component
A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remot
- 9.3 Critical severity
multicluster engine for Kubernetes 2.10: Server-Side Request Forgery
A flaw was found in the `cluster-proxy-addon` component of Multicluster Engine for Kubernetes. This vulnerability allows an unauthenticated attacker, who can access the user-facing route, to bypass authentication and authorization checks. By manipulating URL p
- 9.9 Critical severity
multicluster engine for Kubernetes 2.10: Improper Certificate Validation
A flaw was found in the managedcluster-import-controller. The Certificate Signing Request (CSR) auto-approval logic improperly validates incoming CSRs, specifically by not inspecting the signer name or decoding the PEM-encoded x509 CSR. This vulnerability allo
- 7.1 High severity
multicluster engine for Kubernetes 2.10: Unintended Proxy or Intermediary
A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging
- 9.9 Critical severity
multicluster engine for Kubernetes 2.10: Improper Privilege Management
A flaw was found in the cluster-curator-controller component. A local user, by creating a ClusterCurator resource with a specific naming convention, can trigger the creation of a cluster-scoped ClusterRoleBinding. This allows the user to escalate their privile
- 9.9 Critical severity
multicluster engine for Kubernetes 2.10: Improper Control of Generation of Code
A flaw was found in the cluster-curator-controller component of multicluster engine (MCE). A tenant with create or update permissions on ClusterCurator resources can inject an arbitrary Job specification. This is possible because the CreateJob() function does
- 9.1 Critical severity
multicluster engine for Kubernetes 2.1: Incorrect Privilege Assignment
A flaw was found in the Multicluster Engine for Kubernetes ClusterCurator controller. A tenant administrator with namespace-scoped privileges can exploit this vulnerability by creating a namespaced ClusterCurator. This action inadvertently grants the tenant ad
- 8.5 High severity
multicluster engine for Kubernetes 2.10: Unintended Proxy or Intermediary
A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing cal
- 9.4 Critical severity
multicluster engine for Kubernetes 2.1: Missing Authentication for Critical Functionality
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attac
- 7.5 High severity
fast-uri: Interpretation Conflict
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form
- 9.3 Critical severity
sanitize-html: Improper Neutralization of Input During Web Page Generation
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a d
- 7.5 High severity
form-data: Improper Neutralization of CRLF Sequences
form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage r
- 7.5 High severity
crypto/x509: Unchecked Input for Loop Condition
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification co
- 8.2 High severity
net/http: Improper Validation of Unsafe Equivalence in Input
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege e
- 7.4 High severity
golang.org/x/crypto/ssh/knownhosts: Improper Certificate Validation
Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
- 7.5 High severity
golang.org/x/crypto/ssh: Improper Certificate Validation
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
- 8.7 High severity
golang.org/x/crypto/ssh/agent: Deserialization of Untrusted Data
When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote
- 7.5 High severity
golang.org/x/crypto/ssh: Improper Restriction of Operations within the Bounds of a Memory Buffer
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited globa
- 7.5 High severity
golang.org/x/crypto/ssh: Improper Verification of Cryptographic Signature
The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by u
- 8.8 High severity
golang.org/x/crypto/ssh: Improper Certificate Validation
When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil
- 7.5 High severity
golang.org/x/net/http2: Loop with Unreachable Exit Condition
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
- 7.5 High severity
fast-uri: Interpretation Conflict
fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization. A host that combined an allowed domain, an encoded at-sign, and a different domain was re-emitted with
- 9.1 Critical severity
axios: Improperly Controlled Modification of Dynamically-Determined Object Attributes
Axios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollution "Gadget" attack that allows any Object.prototype pollution in the application's dependency tree to be escalat
- 10.0 Critical severity
axios: Permissive List of Allowed Inputs
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY
- 7.5 High severity
axios: Uncontrolled Recursion
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, toFormData recursively walks nested objects with no depth limit, so a deeply nested value passed as request data crashes the Node.js process with a RangeError. This v
- 7.4 High severity
axios: Improperly Controlled Modification of Object Prototype Attributes
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can (a) silently intercept and mod
- 7.5 High severity
follow-redirects: Exposure of Sensitive Information to an Unauthorized Actor
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorizat
- 7.5 High severity
crypto/x509: Allocation of Resources Without Limits or Throttling
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and
- 7.5 High severity
opentelemetry-go: Allocation of Resources Without Limits or Throttling
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-value independently and aggregates members across values. This allows an attacker to amplify cpu and allocations
- 8.2 High severity
multicluster engine for Kubernetes 2.1: Improper Certificate Validation
A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can b
- 7.5 High severity
go-jose: Uncaught Exception
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSO
- 9.1 Critical severity
grpc-go: Improper Authorization
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests w
- 9.8 Critical severity
immutable-js: Improperly Controlled Modification of Object Prototype Attributes
Immutable.js provides many Persistent Immutable data structures. Prior to versions 3.8.3, 4.3.7, and 5.1.5, Prototype Pollution is possible in immutable via the mergeDeep(), mergeDeepWith(), merge(), Map.toJS(), and Map.toObject() APIs. This issue has been pat