Jason Shepherd

Name of the Vulnerable Software and Affected Versions: openshift/console versions before openshift/console-4 Description: A flaw was found in the OpenShift web console, where the access token is stored in the browser's local storage. An attacker can use this flaw to get the access token via physical access, or an XSS attack on the victim's browser. Recommendations: For openshift/console versions before openshift/console-4, update to openshift/console-4 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive resources that use the access token stored in the browser's local storage.

A flaw was found in atomic-openshift where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the `restuserkey`. An attacker with basic-user permissions is able to obtain the value of `restuserkey`, and use it to authenticate to the GlusterFS REST service, gaining access to read and modify files.

Name of the Vulnerable Software and Affected Versions: openshift4/ose-docker-builder (affected versions not specified) Description: A privilege escalation flaw was found in the build container, which runs with high privileges using a chrooted environment instead of runc. If an attacker gains access to this build container, they can potentially utilize the raw devices of the underlying node, such as the network and storage devices, to escalate their privileges to that of the cluster admin. The highest threat from this issue is to data confidentiality and integrity as well as system availability. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A signature verification issue exists, allowing an attacker to bypass SAML Authentication, posing a threat to confidentiality, integrity, and system availability. This issue can be exploited by forging part of a signed XML document. The go `encoding/xml` package is also affected, where a crafted XML document may cause XML Digital Signature validation to be entirely bypassed.

The issue is related to an integer overflow vulnerability in the length of websocket frames received via a websocket connection. This flaw can be exploited by an attacker to cause a denial of service attack on an HTTP Server that allows websocket connections. An attacker can craft malicious WebSocket frames that cause an integer overflow in a variable which tracks the number of bytes remaining, potentially causing the server or client to get stuck in a loop attempting to read frames.

A flaw in OpenShift Container Platform's distribution of Kibana allows it to be opened in an iframe, enabling an attacker to intercept and manipulate requests. This issue can be exploited to trick a user into performing arbitrary actions in Kibana, such as clickjacking.

A security issue was found in the Quay web GUI, where the CSRF token, used in POST requests, is not refreshed after each request or when a user logs out and back in. This allows an attacker to potentially use a leaked token to access the system using the user's account.

A flaw was discovered in the upgrade process of OpenShift Container Platform, specifically when using CRI-O. The issue allows an unprivileged user to escalate their privileges to those allowed by the privileged Security Context Constraints, as the dockergc service account is assigned to the current namespace of the user performing the upgrade.

A cross-site scripting flaw exists in the tetonic-console component. An attacker with the ability to create pods can use this flaw to perform actions on the K8s API as the victim.

The issue is related to an out-of-bounds write that can occur when patching an OpenShift object using the `oc patch` functionality. This can be exploited to cause a denial of service attack on the OpenShift master API service, which provides cluster management. A malicious JSON patch can cause a panic due to an out-of-bounds write attempt, potentially serving as a denial of service vector if exposed to arbitrary user input.

A flaw was discovered in the Karaf container used by Red Hat JBoss Fuse and Red Hat JBoss A-MQ, where it deserializes objects passed to MBeans via JMX operations. This could allow an attacker to execute remote code on the server as the user running the Java Virtual Machine if the target MBean contains deserialization gadgets in its classpath.

A flaw was discovered in the JMX endpoint, allowing it to deserialize credentials passed to it. This could be exploited by an attacker to launch a denial of service attack.

A malicious network-policy configuration can cause Openshift Routing to crash when using the ovs-networkpolicy plugin, potentially leading to a Denial of Service (DoS) attack on an Openshift Cluster.

A code injection issue was found in the JAXP implementation used for XSLT processing, which could allow an attacker to achieve remote code execution if they can provide XSLT content for parsing. The issue involves the use of a `javax.xml.transform.TransformerFactory` for doing transforms. Setting the `FEATURE SECURE PROCESSING` feature to `true` mitigates this issue.

The issue is related to improper input validation of the Openshift Routing configuration, which can cause an entire shard to be brought down. A malicious user can exploit this to cause a Denial of Service attack for other users of the router shard.

The issue concerns the deserialization of untrusted data in the JMX endpoint, specifically when it deserializes credentials passed to it. An attacker could exploit this, resulting in a denial of service attack.

The issue allows for server side request forgery (SSRF) through the external request API call. This could enable an attacker to probe internal network resources and access restricted endpoints.

The issue is related to inconsistent interpretation of HTTP requests, which can be exploited by a remote attacker to compromise data integrity. This can result in server-side cache poisoning or CORS requests in the JAX-RS component.

The issue allows GET requests to disclose internal IP addresses to remote attackers.

The issue allows remote attackers to execute arbitrary code via a crafted serialized payload. This is related to the PooledInvokerServlet in the affected software.