Red Hat OpenShift Update Service vulnerabilities
7 known vulnerabilities in Red Hat OpenShift Update Service from Red Hat. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.1 High severity
Red Hat OpenShift Update Service: Server-Side Request Forgery
A flaw was found in Red Hat Quay. A user with FEATURE_BUILD_SUPPORT enabled and repository write access can exploit a Server-Side Request Forgery (SSRF) vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay build
- 7.5 High severity
Red Hat OpenShift Update Service: Missing Authentication for Critical Functionality
A flaw was found in Red Hat Quay's exported logs feature. An unauthenticated attacker with a valid file ID could download exported action logs without proper authorization. While file IDs are complex, they can be intercepted from plaintext email or webhook cal
- 7.5 High severity
Red Hat OpenShift Update Service: Improper Verification of Cryptographic Signature
A flaw was found in Red Hat Quay's Stripe billing webhook handler. This vulnerability allows an unauthenticated attacker to forge billing events by sending crafted JSON requests to the `/webhooks/stripe` endpoint without validating the Stripe-Signature header.
- 8.2 High severity
Red Hat OpenShift Update Service: Missing Authentication for Critical Functionality
A flaw was found in Red Hat Quay. When the SECURITY_SCANNER_V4_PSK (pre-shared key) is not set, a remote unauthenticated attacker can send POST requests to the security scanner notification endpoint. This allows the attacker to flood the notification queue and
- 7.3 High severity
A security vulnerability has been detected in libssh2 up to 1.11.1.
A security vulnerability has been detected in libssh2 up to 1.11.1. The impacted element is the function userauth_password of the file src/userauth.c. Such manipulation of the argument username_len/password_len leads to integer overflow. The attack may be laun
- 7.5 High severity
AWS-LC: Improper Verification of Cryptographic Signature
Improper signature validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass signature verification when processing PKCS7 objects with Authenticated Attributes. Customers of AWS services do not need to take action. Applications using AWS-
- 7.5 High severity
AWS-LC: Improper Certificate Validation
Improper certificate validation in PKCS7_verify() in AWS-LC allows an unauthenticated user to bypass certificate chain verification when processing PKCS7 objects with multiple signers, except the final signer. Customers of AWS services do not need to take acti