Patrick Del Bello

A flaw was found in Stackrox, where it is vulnerable to Cross-site scripting (XSS) if the script code is included in a small subset of table cells. The only known potential exploit is if the script is included in the name of a Kubernetes “Role” object that is applied to a secured cluster. This object can be used by a user with access to the cluster or through a compromised third-party product.

A flaw in smallrye-fault-tolerance allows an out-of-memory (OOM) condition, which occurs when the system runs out of available RAM. This issue is externally triggered by calling the metrics URI, where each request creates a new object within the `meterMap` variable, potentially leading to a denial of service (DoS).

A issue was found in KeyCloak that may allow a privileged attacker to use a malicious payload as the permission while creating items from the admin console, leading to a stored cross-site scripting (XSS) attack.

A flaw was found in the software, allowing a namespace to create a rogue PrometheusRule when the `openshift.io/cluster-monitoring` label is applied to all namespaces that deploy an ArgoCD CR instance. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.

A vulnerability was found in Keycloak where expired OTP codes are still usable when using FreeOTP with the default OTP token period of 30 seconds. Instead of expiring after 30 seconds, the tokens remain valid for an additional 30 seconds, totaling 1 minute. This increases the attack window for malicious actors to abuse the system and compromise accounts, as well as the attack surface, since two OTPs are valid at any given time.

An open redirect issue exists in Keycloak, where a specially crafted URL can be constructed to trick users into visiting a malicious webpage. The `referrer` and `referrer uri` parameters can be manipulated to make a trusted URL appear safe, when in fact it redirects to a malicious server. This can lead to successful phishing attacks or other types of attacks. A malicious actor can send a crafted URL to a Keycloak admin via email, triggering the vulnerability when the user visits the page and clicks the link. The malicious actor can also obfuscate the `redirect uri` using URL encoding to hide the text of the actual malicious website domain.

Name of the Vulnerable Software and Affected Versions: Undertow (affected versions not specified) Description: A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent, but the client would continue waiting as Undertow does not send the expected `0r ` termination of the chunked response. This results in uncontrolled resource consumption, leaving the server side to a denial of service attack. This happens only with Java 17 TLSv1.3 scenarios. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability was found in Undertow, which requires the learning-push handler to be enabled in the server's config. By default, this handler is disabled. If enabled and the maxAge config in the handler is left unconfigured, the default value of -1 makes the handler vulnerable. An attacker needs to be able to reach the server with a normal HTTP request to exploit this issue.

Name of the Vulnerable Software and Affected Versions: Keycloak (affected versions not specified) Description: A flaw in the LDAP testing endpoint allows an attacker with admin access to change the LDAP host URL to a machine they control, potentially leaking domain credentials. This can be achieved by modifying the "Connection URL" independently without re-entering the currently configured LDAP bind credentials. As a consequence, an attacker who has compromised the admin console or a user with sufficient privileges can leak domain credentials and attack the domain. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: 389-ds-base (affected versions not specified) Description: A denial of service issue was found in the 389-ds-base LDAP server, which may allow an authenticated user to cause a server denial of service while attempting to log in with a user who has a malformed hash in their password. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: libndp (affected versions not specified) Description: A flaw in libndp allows a local malicious user to cause a buffer overflow in NetworkManager. This issue is triggered by sending a malformed IPv6 router advertisement packet, as libndp does not correctly validate the route length information. The exploitation of this issue may allow an attacker to impact the confidentiality, integrity, and availability of protected information. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A vulnerability was found in Satellite where the host's SSH key is not being checked when running a remote execution job on a host. This is due to the use of "-o StrictHostKeyChecking=no", which allows the Satellite to connect to the host even when the SSH key changes. This flaw can lead to a man-in-the-middle attack (MITM), denial of service, leaking of secrets the remote execution job contains, or other issues that may arise from the attacker's ability to forge an SSH key.

A vulnerability was found in Wildfly’s management interface, where the lack of limitation of sockets for the management interface may cause a denial of service by hitting the nofile limit, as there is no possibility to configure or set a maximum number of connections.

A flaw was found in Keycloak's redirect uri validation logic, which may allow a bypass of otherwise explicitly allowed hosts. This issue could lead to the theft of an access token, enabling an attacker to impersonate other users.

Name of the Vulnerable Software and Affected Versions: Keycloak (affected versions not specified) Description: A flaw was found in the Keycloak package due to a permissive regular expression hardcoded for filtering, which allows hosts to register a dynamic client. A malicious user with enough information about the environment could jeopardize an environment with this specific Dynamic Client Registration and TrustedDomain configuration previously unauthorized. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. The flaw affects any client that utilizes a wildcard in the `Valid Redirect URIs` field and requires user interaction within the malicious URL.

A vulnerability was found in the quarkus-core component. Quarkus captures local environment variables from the Quarkus namespace during the application's build, and the resulting application inherits these values. Some local environment variables may have been set for testing purposes, such as dropping the database during application startup or trusting all TLS certificates. If these properties are configured using environment variables or the .env facility, they are captured into the built application, leading to potentially dangerous behavior if not overridden. This behavior only affects configuration properties from the `quarkus.*` namespace.

The issue is related to incorrect handling of insufficient permissions or privileges in the 3Scale API Management software. When the `auth type` is set to `use 3scale oidc issuer endpoint`, the Token Introspection policy fails to inspect tokens due to the removal of the `token introspection endpoint` field in RH-SSO 7.5. As a result, the policy determines that all tokens are valid. This could allow a remote attacker to execute arbitrary code.

A vulnerability was found in Undertow that impacts servers supporting the wildfly-http-client protocol. When a malicious user opens and closes a connection with the HTTP port of the server and then closes the connection immediately, the server will end with both memory and open file limits exhausted at some point, depending on the amount of memory available. At HTTP upgrade to remoting, the `WriteTimeoutStreamSinkConduit` leaks connections if `RemotingConnection` is closed by `Remoting ServerConnectionOpenListener`. This is because the remoting connection originates in Undertow as part of the HTTP upgrade and is unaware of the outermost layer when closing the connection during the connection opening procedure, resulting in the `WriteTimeoutStreamSinkConduit` not being notified of the closed connection. The `WriteTimeoutStreamSinkConduit` creates a timeout task that is added to XNIO WorkerThread, causing the whole dependency tree to leak via that task.

A vulnerability was found in python-glance-store. The issue occurs when the package logs the `access key` for the glance-store when the DEBUG log level is enabled.