Jba

**Name of the Vulnerable Software and Affected Versions** Openshift Origin version 3 **Description** The issue is related to insecure cookies being set in the console of Openshift Origin. Specifically, the cookies lack 'secure' and 'HttpOnly' attributes. **Recommendations** For Openshift Origin version 3, consider configuring the console to set secure cookies with 'secure' and 'HttpOnly' attributes to mitigate the risk. As a temporary workaround, restrict access to sensitive data transmitted via cookies until a proper fix is applied.

**Name of the Vulnerable Software and Affected Versions** Hashicorp go-getter library versions prior to 1.5.11 **Description** The issue concerns the Hashicorp go-getter library, where SSH credentials could be written into its logfile. This exposes sensitive credentials to local users who have the ability to read the logfile. **Recommendations** For versions prior to 1.5.11, update to version 1.5.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the logfile to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** http-swagger versions prior to 1.2.6 **Description** The issue allows an attacker to perform a denial of service attack consisting of memory exhaustion on the host system due to improper handling of HTTP methods. This can also lead to other unexpected behaviors such as cross-site scripting (XSS) attacks by uploading malicious files. Users are advised to upgrade to prevent memory exhaustion and potential XSS attacks. **Recommendations** For versions prior to 1.2.6, upgrade to version 1.2.6 to resolve the issue. As a temporary workaround for users unable to upgrade, restrict the path prefix to the "GET" method to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Ignition versions prior to 2.14.0 **Description** A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. **Recommendations** For Ignition versions prior to 2.14.0, consider upgrading to Ignition 2.14.0 or later, which adds a new systemd service, `ignition-delete-config.service`, that deletes the Ignition config from supported hypervisors during the first boot. As a temporary workaround, avoid storing secrets in Ignition configs. If you have external tooling that requires the Ignition config to remain accessible in VM metadata after provisioning, and your Ignition config does not include sensitive information, you can prevent Ignition 2.14.0 and later from deleting the config by masking `ignition-delete-config.service`.