Avinash Hanwate

A flaw exists in the JSONPath slice evaluator used by the `json path query()` function. When provided with a slice expression containing a negative step, the evaluator can enter an infinite loop. This can lead to a denial of service by forcing an application that processes attacker-controlled JSONPath expressions to hang.

An authentication bypass issue has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. The flaw impacts all active Satellite deployments and could potentially enable unauthorized users to gain administrative access. Over 4,000 results are found on ZoomEye, indicating a significant number of potentially affected devices.

A flaw was found in the Fence Agents Remediation operator, allowing a Remote Code Execution (RCE) primitive by supplying an arbitrary command to execute in the `--ssh-path`/`--telnet-path` arguments. This can lead to a privilege escalation, first as the service account running the operator, then to another service account with cluster-admin privileges. A low-privilege user, such as a user with developer access, can create a specially crafted FenceAgentsRemediation for a fence agent supporting `--ssh-path`/`--telnet-path` arguments to execute arbitrary commands on the operator's pod.

A flaw was found in NetworkManager, allowing a malicious user to inject a malformed LLDP packet when the system is running NetworkManager with DEBUG logs enabled and an interface configured with LLDP enabled. This could cause NetworkManager to crash, leading to a denial of service. The issue is related to an uncontrolled resource consumption, which can be exploited by a remote attacker to cause a denial of service.

Name of the Vulnerable Software and Affected Versions: cockpit (affected versions not specified) Description: A flaw was found in the cockpit package, allowing an authenticated user to kill any process when enabling the pam env's `user readenv` option. This leads to a denial of service (DoS) attack. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An authentication bypass issue has been identified due to Apache's mod proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14, and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access.

A use-after-free flaw was found in PackageKitd. In some conditions, the order of cleanup mechanics for a transaction could be impacted, resulting in memory access on previously freed memory regions. Once freed, a memory region can be reused for other allocations, and any previously stored data in this memory region is considered lost.

A flaw was found in the mod proxy cluster in the Apache server, which may allow a malicious user to add a script in the `alias` parameter in the URL to trigger a stored cross-site scripting (XSS) vulnerability. By adding a script to the `alias` parameter on the URL, it adds a new virtual host and adds the script to the cluster-manager page.

A flaw was found in Quay, where clickjacking allows an attacker to trick a user into clicking on a button or link on another page. The config-editor page is vulnerable to clickjacking, which could allow an attacker to trick an administrator user into clicking on buttons on the config-editor panel, possibly reconfiguring some parts of the Quay instance. Clickjacking is a technique used by attackers to trick users into clicking on something different from what they intend, by using multiple transparent or opaque layers.

A flaw was found in Quay, allowing cross-site request forgery (CSRF) attacks to force a user to perform unwanted actions in an application. The config-editor page, used to configure the Quay instance, is vulnerable to CSRF. By coercing the victim's browser into sending an attacker-controlled request from another domain, it is possible to reconfigure the Quay instance, including adding users with admin privileges.

A flaw was found in openshift-logging LokiStack, where the key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.

An uncontrolled resource consumption flaw was found in openstack-neutron, allowing a remote authenticated user to query a list of security groups for an invalid project. This issue creates resources that are unconstrained by the user's quota, potentially leading to a denial of service if a malicious user submits a significant number of requests.

A flaw was found in the Quay registry where image labels created through Quay undergo validation in the UI and backend using a regex, but the same validation is not performed when the label comes from an image. This allows an attacker to publish a malicious image to a public registry containing a script that can be executed via Cross-site scripting (XSS).

A flaw was found in coreDNS, allowing a malicious user to reroute internal calls to some internal services that were accessed by the FQDN in a format of `<service>.<namespace>.svc`.

A flaw was found in coreDNS, allowing a malicious user to redirect traffic intended for external top-level domains (TLD) to a pod they control by creating projects and namespaces that match the TLD.

The issue is related to the ovirt-engine management tool for virtual infrastructure, which fails to protect its web page structure when handling the `error description` parameter. This allows a remote attacker to conduct cross-site scripting attacks. The vulnerability is triggered by the failure to sanitize the entry for the `error description` parameter on the Windows Service Accounts home pages.

A user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct traffic to an arbitrary application within the cluster, including one under attacker control.

A flaw was found in the search-api container when a query in the search filter gets parsed by the backend. This issue allows an attacker to craft specific strings containing special characters that lead to crashing the pod, affecting system availability while restarting.

The issue concerns password protection not being enabled by default. In cases where no password is set at the controller, there is no information or prompt to enable password protection at login.

A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes, related to insufficient protection of service data in the GraphQL API. This issue allows authenticated users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges. The flaw is associated with the inadequate sanitization of Notifier secrets in the GraphQL API.