Openshift Update Service vulnerabilities
4 known vulnerabilities in Openshift Update Service from Red Hat. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.1 High severity
Red Hat OpenShift Update Service: Server-Side Request Forgery
A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay build
- 7.5 High severity
Red Hat OpenShift Update Service: Missing Authentication for Critical Functionality
A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook cal
- 7.5 High severity
Red Hat OpenShift Update Service: Improper Verification of Cryptographic Signature
A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header.
- 8.2 High severity
Red Hat OpenShift Update Service: Missing Authentication for Critical Functionality
A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and