Doran Moppert

Foi identificada uma falha no argocd que permite que qualquer usuário sem privilégios implante o argocd em seu namespace. Com a conta de serviço criada `argocd-argocd-server`, o usuário sem privilégios pode ler todos os recursos do cluster, incluindo todos os segredos, o que pode possibilitar a escalada de privilégios. A maior ameaça decorrente desse problema é à confidencialidade dos dados.

Foi identificada uma falha no provisionamento das APIs de serviços internos, que foram configuradas incorretamente utilizando um certificado de teste do repositório de código-fonte. Isso faz com que todas as instalações utilizem os mesmos certificados. Se um invasor puder observar o tráfego de rede interno de um cluster, ele poderá usar a chave privada para decodificar solicitações de API que deveriam ser protegidas por sessões TLS, obtendo potencialmente informações que, de outra forma, não conseguiria. Esses certificados não são usados para autenticação de serviço, portanto, não há possibilidade de suplantar identidade ou realizar ataques MITM ativos.

Foi descoberta uma vulnerabilidade de negação de serviço no nbdkit. Um invasor poderia se conectar ao serviço nbdkit, fazendo com que ele realizasse uma grande quantidade de trabalho na inicialização de plug-ins de back-end simplesmente ao abrir uma conexão com o serviço. Isso poderia causar consumo de recursos e degradação do serviço no nbdkit, dependendo dos plug-ins configurados no lado do servidor.

Name of the Vulnerable Software and Affected Versions: oVirt Metrics (affected versions not specified) Description: The issue concerns sensitive passwords used in the deployment and configuration of oVirt Metrics. These passwords are insufficiently protected and could be disclosed in log files if playbooks are run with the -v option or in playbooks stored on Metrics or Bastion hosts. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A flaw in fence-agents can cause the fence rhevm component to exit with an exception when non-ASCII characters are used in certain fields of a guest VM, such as comments. This issue can lead to denial of service in cluster environments, preventing automated recovery. The vulnerability is related to encoding errors and can be exploited by a remote attacker to cause a denial of service.

The issue is related to the `virConnectGetDomainCapabilities()` function in the libvirt API, which accepts an `emulatorbin` argument. This argument can be used to specify a program for domain emulation. Since version 1.2.19, libvirt executes the specified program to probe domain capabilities. A problem arises because read-only clients can provide an arbitrary path for the `emulatorbin` argument, potentially causing libvirtd to execute a crafted executable with its own privileges. This is due to errors in access control.

The issue is related to insufficient access control in the `virDomainManagedSaveDefineXML()` API, allowing readonly clients to modify managed save state files. If a managed save was created by a privileged user, a local attacker could modify this file to execute an arbitrary program when the domain is resumed. This could potentially allow an attacker to change arbitrary files by sending a specially crafted request.

The gnome-shell lock screen does not properly restrict all contextual actions, allowing an attacker with physical access to a locked workstation to invoke certain keyboard shortcuts and potentially other actions.

The issue concerns improper restriction of access to the infopipe based on the `allowed uids` configuration parameter. This could lead to the disclosure of sensitive information stored in the user directory to local attackers.

The issue allows an attacker to cause a denial of service condition by uploading a specially crafted image, which could consume unbounded amounts of memory or CPU time, potentially impacting other users of the host.

The issue allows for information exposure through log files. When the engine-backup command is run with certain options, such as `--provision*db`, the database `username` and `password` are logged in cleartext. This could lead to database passwords being leaked if the provisioning log is shared.

The issue is due to a missing no log directive in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook, which results in the inadvertent disclosure of admin passwords in the provisioning log. This could lead to privilege escalation in environments where logs are shared with other parties.

The web console login form in oVirt Engine returned different errors for non-existent users and invalid passwords. This allowed an attacker to discover the names of valid user accounts by exploiting the difference in error responses.

The issue allows exposure of Power Management credentials, including cleartext passwords, to Host Administrators. A Host Administrator could exploit this to gain access to the power management systems of hosts they control.

The issue is related to errors in authorization. It violates security assumptions made by pam shells and some daemons, which allow access based on a user's shell being listed in /etc/shells. Under some circumstances, users who had their shell changed to /sbin/nologin could still access the system. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

A vulnerability was discovered where the combination of Enable Discard and Wipe After Delete flags for VM disks could cause a disk to be incompletely zeroed when removed from a VM. This could potentially reveal sensitive data to privileged users of another VM if the same storage blocks are later allocated to a new disk.

The issue concerns external entity expansion (XXE) not being disabled when parsing an SVG file. This could allow an attacker to craft a malicious SVG file, potentially leading to denial of service or information disclosure when processed by an application using the affected software.

A heap-based buffer overflow flaw was found in the patch for a previous issue. A crafted j2k image could cause the application to crash, or potentially execute arbitrary code.

The issue is related to the mtree bidder in libarchive, which does not properly track line sizes when extending the read-ahead. This allows remote attackers to cause a denial of service, resulting in a crash, by providing a crafted file. The crash is triggered by an invalid read in either the `detect form` or `bid entry` function in libarchive/archive read support format mtree.c.

The issue is related to a stack-based buffer overflow in the safe fprintf function, located in tar/util.c. This overflow can be triggered by remote attackers who send a crafted non-printable multibyte character in a filename, potentially causing a denial of service.