Openshift Container Platform vulnerabilities
71 known vulnerabilities in Openshift Container Platform from Red Hat. 71 are rated high or critical, and 7 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.8 High severity
Red Hat OpenShift Container Platform 4.18: Improper Limitation of a Pathname to a Restricted Directory
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with
- 7.5 High severity
Red Hat build of Apache Camel 4.4.1 for Spring…: Uncontrolled Resource Consumption
A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the
- 7.1 High severity
Red Hat build of Keycloak 22: URL Redirection to Untrusted Site
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users
- 7.5 High severity
Red Hat OpenShift Container Platform 4.13: Allocation of Resources Without Limits or Throttling
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of servic
- 8.1 High severity
Red Hat Single Sign-On 7: Improperly Implemented Security Check for Standard
Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth
- 7.7 High severity
Red Hat Single Sign-On 7.6 for RHEL 7: Allocation of Resources Without Limits or Throttling
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessio
- 7.2 High severity
Red Hat OpenShift Container Platform 4.11: Improper Privilege Management
A privilege escalation flaw was found in the node restriction admission plugin of the kubernetes api server of OpenShift. A remote attacker who modifies the node role label could steer workloads from the control plane and etcd nodes onto different worker nodes
- 7.5 High severity
kubernetes: Incorrect Authorization
A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.
- 7.1 High severity
Red Hat Single Sign-On 7: Improper Certificate Validation
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, the
- 7.5 High severity
Red Hat Fuse 7.12.1: Memory Allocation with Excessive Size Value
A flaw was found in undertow. Servlets annotated with @MultipartConfig may cause an OutOfMemoryError due to large multipart content. This may allow unauthorized users to cause remote Denial of Service (DoS) attack. If the server uses fileSizeThreshold to limit
- 8.0 High severity
Red Hat OpenShift Container Platform 4.10: Authentication Bypass Using an Alternate Path or Channel
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would th
- 9.8 Critical severity
RHEL-8 based Middleware Containers: Incorrect Default Permissions
A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensit
- 8.1 High severity
Openshift Serverless 1 on RHEL 8: Incorrect Authorization
A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy alt
- 7.5 High severity
EAP 7.4.10 release: Loop with Unreachable Exit Condition
A flaw was found in undertow. This issue makes achieving a denial of service possible due to an unexpected handshake status updated in SslConduit, where the loop never terminates.
- 7.5 High severity
openshift: Weak Password Requirements
A compliance problem was found in the Red Hat OpenShift Container Platform. Red Hat discovered that, when FIPS mode was enabled, not all of the cryptographic modules in use were FIPS-validated.
- 8.2 High severity
openvswitch: Always-Incorrect Control Flow Implementation
A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matchi
- 7.0 High severity
Runc: Use of Incorrectly-Resolved Name or Reference
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom i
- 7.1 High severity
buildah: Incorrect Authorization
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to
- 7.1 High severity
podman: Incorrect Authorization
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to
- 8.6 High severity
dpdk: Incomplete Filtering of Special Elements
A permissive list of allowed inputs flaw was found in DPDK. This issue allows a remote attacker to cause a denial of service triggered by sending a crafted Vhost header to DPDK.
- 7.5 High severity
CRI-O: Allocation of Resources Without Limits or Throttling
A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after com
- 8.8 High severity
psgo: Improper Privilege Management
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. Thi
- 7.5 High severity
crun: Incorrect Default Permissions
A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw
- 7.5 High severity
podman: Incorrect Default Permissions
A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This f
- 7.5 High severity
haproxy: Loop with Unreachable Exit Condition
A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The
- 7.8 High severity
Red Hat Polkit Incorrect Authorization Exploited
It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local adminis
- 7.8 High severity
Apache HTTP Server Privilege Escalation Exploited
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privi
- 10.0 Critical severity
Kibana Arbitrary Code Execution Exploited
Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an a
- 9.9 Critical severity
Jenkins Matrix Project Plugin Remote Code Execution Exploited
A sandbox bypass vulnerability exists in Jenkins Pipeline: Groovy Plugin 2.63 and earlier in pom.xml, src/main/java/org/jenkinsci/plugins/workflow/cps/CpsGroovyShell.java that allows attackers able to control pipeline scripts to execute arbitrary code on the J
- 9.9 Critical severity
Jenkins Script Security Plugin Sandbox Bypass Exploited
A sandbox bypass vulnerability exists in Jenkins Script Security Plugin 1.53 and earlier in src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/GroovySandbox.java, src/main/java/org/jenkinsci/plugins/scriptsecurity/sandbox/groovy/SecureGroovyScri
- 9.8 Critical severity
Jenkins Stapler Web Framework Deserialization of Untrusted Data Exploited
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by acces