Red Hat Advanced Cluster Management for Kubernetes 2.17 vulnerabilities
32 known vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.17 from Red Hat. 32 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.7 High severity
Red Hat Advanced Cluster Management for…: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
A cross-namespace authorization flaw in multicluster-observability-addon allows a user with permission to modify a managed cluster’s ManagedClusterAddOn configuration to reference ClusterLogForwarder or OpenTelemetryCollector resources outside the permitted na
- 9.1 Critical severity
Red Hat Advanced Cluster Management for…: Improper Control of Generation of Code
A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes n
- 7.7 High severity
Red Hat Advanced Cluster Management for…: Exposure of Sensitive Information to an Unauthorized Actor
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `Ge
- 9.9 Critical severity
Red Hat Advanced Cluster Management for…: Unintended Proxy or Intermediary
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources (CRs), to bypass existing security controls. The system's HelmRelease controller processes Helm
- 9.9 Critical severity
Red Hat Advanced Cluster Management for…: Use of Unmaintained Third Party Components
A flaw was found in Lighthouse. A remote attacker, by compromising a spoke cluster, can exploit a vulnerability where the destination namespace for resource injection is derived from an attacker-controlled label or annotation on the broker object. This allows
- 8.7 High severity
Red Hat Advanced Cluster Management for…: Insufficient Verification of Data Authenticity
A flaw was found in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. This vulnerability stems from insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this by c
- 8.7 High severity
Red Hat Advanced Cluster Management for…: Insufficient Verification of Data Authenticity
A flaw was found in Submariner. This vulnerability allows a malicious cluster (spoke) to redirect network traffic from other connected clusters (peer clusters) by publishing a specially crafted network endpoint. The system fails to properly validate the networ
- 8.0 High severity
Red Hat Advanced Cluster Management for…: Inclusion of Functionality from Untrusted Control Sphere
A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verifying its authenticity or integrity. This script gains access to sensitive credentials, such as GitHub access tokens and
- 9.9 Critical severity
Red Hat Advanced Cluster Management for…: Execution with Unnecessary Privileges
A flaw was found in search-v2-operator. The operator's ClusterRole has permissions equivalent to a cluster administrator, allowing it to impersonate other entities, write Role-Based Access Control (RBAC) configurations, approve Certificate Signing Requests (CS
- 9.1 Critical severity
Red Hat Advanced Cluster Management for…: Improper Control of Dynamically-Managed Code Resources
A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploi
- 8.8 High severity
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced…
A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This
- 9.1 Critical severity
Red Hat Advanced Cluster Management for…: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource (CR) editor, to inject malicious shell commands or SQL statements. This occurs because the WORK_MEM string pro
- 8.8 High severity
Red Hat Advanced Cluster Management for…: Improper Privilege Management
A flaw was found in search-v2-operator. This component's `search-serviceaccount` has overly broad permissions, allowing it to impersonate users and groups across the entire cluster. If an attacker gains access to any of the pods running under this service acco
- 9.9 Critical severity
Multicluster Global Hub 1.4.9: Incorrect Authorization
A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker t
- 8.5 High severity
Red Hat Advanced Cluster Management for…: Improperly Controlled Modification of Dynamically-Determined Object Attributes
A flaw was found in the `search-v2-operator` component. A user with specific administrative permissions on a managed cluster can exploit a vulnerability that allows them to inject arbitrary configuration data. This manipulation can override critical settings,
- 9.0 Critical severity
Red Hat Advanced Cluster Management for…: Inclusion of Functionality from Untrusted Control Sphere
A flaw was found in acm-search-v2-rhel9. An attacker with administrative privileges on the hub cluster, specifically with patch access to the Search Custom Resource (CR), could exploit a vulnerability in the `Collector.ImageOverride` field. This allows the att
- 7.5 High severity
Red Hat Advanced Cluster Management for…: Allocation of Resources Without Limits or Throttling
A flaw was found in search-v2-api. An unauthenticated attacker can exploit this by sending requests with unique random bearer tokens. Each unique token creates a permanent entry in the unbounded tokenReviews cache, which is not properly cleared. This can lead
- 9.9 Critical severity
Red Hat Advanced Cluster Management for…: Execution with Unnecessary Privileges
A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a namespace-admin tenant to perform a confused-deputy attack by creating Subscription Custom Resources (CRs) that leve
- 7.7 High severity
Red Hat Advanced Cluster Management for…: Improper Privilege Management
A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent ca
- 9.9 Critical severity
Red Hat Advanced Cluster Management for…: Unintended Proxy or Intermediary
A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Application
- 9.6 Critical severity
Red Hat Advanced Cluster Management for…: Unintended Proxy or Intermediary
A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redi
- 7.7 High severity
Red Hat Advanced Cluster Management for…: Authorization Bypass Through User-Controlled Key
A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field,
- 7.7 High severity
Red Hat Advanced Cluster Management for…: Insertion of Sensitive Information into Log File
A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the to
- 7.5 High severity
Red Hat Advanced Cluster Management for…: Improper Authentication
A flaw was found in search-v2-api. The authentication middleware in the affected component unconditionally skips authentication when a request includes an `Upgrade: websocket` header. An unauthenticated attacker can exploit this by sending a specially crafted
- 9.0 Critical severity
Red Hat Advanced Cluster Management for…: Privilege Defined With Unsafe Actions
A flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create a Channel resource
- 7.5 High severity
fast-uri: Interpretation Conflict
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form
- 9.3 Critical severity
sanitize-html: Improper Neutralization of Input During Web Page Generation
ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. Under the default configuration, versions of `sanitize-html` prior to 2.17.4 can turn attacker-controlled content inside a d
- 7.5 High severity
crypto/x509: Unchecked Input for Loop Condition
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification co
- 7.5 High severity
avro: Uncontrolled Resource Consumption
iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, the Avro array and map decoders looped over an attacker-controlled block-count value without checking the underlying reader's error state inside the loop body. Reader.ReadBlockHeader returns the count a
- 7.5 High severity
avro: Integer Overflow or Wraparound
iskorotkov/avro is a fast Go Avro codec. Prior to 2.33.0, several Avro decoder paths read attacker-controlled 64-bit values from the wire format and either narrowed them to platform-sized int before bounds-checking, or summed them with overflow-prone signed-in
- 7.5 High severity
prometheus: Uncontrolled Resource Consumption
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the remote read endpoint (/api/v1/read) does not validate the declared decoded length in a snappy-compressed request body before allocating memory. An
- 7.5 High severity
prometheus: Exposure of Sensitive Information to an Unauthorized Actor
Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus red