Dave Baker

The issue allows an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of their choosing, originating from the RHSSO installation. By observing differences in the timings of these scans, an attacker may gather information about hosts and ports they do not have access to scan directly.

An information disclosure issue was found in Red Hat Quay. This flaw allows an attacker who can create a build trigger in a repository to disclose the names of robot accounts and the existence of private repositories within any namespace.

The issue is related to the configuration of Syndesis, specifically with Cross-Origin Resource Sharing (CORS) set to allow all origins, which could be exploited by an attacker to conduct phishing attacks and gain unauthorized access to information. Additionally, there is a vulnerability related to insufficient input validation, which could allow an attacker to obtain unauthorized access to protected information.