Antony Di Scala

Name of the Vulnerable Software and Affected Versions Red Hat Quay (affected versions not specified) Description A flaw exists in Red Hat Quay's Proxy Cache configuration feature. When an organization administrator configures an upstream registry for proxy caching, Quay establishes a network connection to the specified registry hostname without validating that it points to a legitimate external service. An attacker possessing organization administrator privileges could provide a manipulated hostname, causing the Quay server to make requests to internal network services, cloud infrastructure endpoints, or other resources that should be inaccessible to the Quay application. Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A container privilege escalation flaw exists due to the /etc/passwd file being created with group-writable permissions during the build process. An attacker with the ability to execute commands within an affected container, even as a non-root user, can exploit their root group membership to modify the /etc/passwd file. This allows the addition of a new user with an arbitrary UID, potentially including UID 0, resulting in full root privileges within the container.

Name of the Vulnerable Software and Affected Versions: mirror-registry (affected versions not specified) Description: The mirror-registry does not properly sanitize the host header HTTP header in received HTTP requests, which allows an attacker to perform malicious redirects to attacker-controlled domains or phishing campaigns. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Early versions of Operator-SDK included an insecure method for operator containers to run in environments utilizing a random UID. A script, `user setup`, modified the permissions of the `/etc/passwd` file to 664 during build time. An attacker executing commands within an affected container, even as a non-root user, could leverage root group membership to modify the `/etc/passwd` file. This could allow the addition of a new user with an arbitrary UID, potentially including UID 0, resulting in full root privileges within the container.

A flaw was found in the Mirror Registry. The quay-app container shipped as part of the Mirror Registry for OpenShift has write access to the `/etc/passwd` file. This flaw allows a malicious actor with access to the container to modify the passwd file and elevate their privileges to the root user within that pod.

A flaw was found in OpenShift Service Mesh due to improper HTTP header sanitization in Envoy. This may lead to rate-limiter avoidance, access-control bypass, CPU and memory exhaustion, and replay attacks.

The issue occurs due to improper sanitization of HTTP headers by Envoy, particularly the `x-forwarded-for` header. This lack of sanitization can allow attackers to inject malicious payloads into service mesh logs, leading to log injection and spoofing attacks. Such injections can mislead logging mechanisms, enabling attackers to manipulate log entries or execute reflected cross-site scripting (XSS) attacks.