CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2019-10225
https://notcve.org/view.php?id=CVE-2019-10225
A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and use it to authenticate to the GlusterFS REST service, gaining access to read, and modify files. Se encontró un fallo en atomic-openshift de openshift-4.2, donde el rol de usuario básico RABC en OpenShift Container Platform no protege suficientemente el GlusterFS StorageClass contra filtraciones del restuserkey. Un atacante con permisos de usuario básico puede obtener el valor de restuserkey y usarlo para autenticarse en el servicio REST de GlusterFS, consiguiendo acceso para leer y modificar archivos • https://bugzilla.redhat.com/show_bug.cgi?id=1743073 • CWE-522: Insufficiently Protected Credentials •
CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-14336 – openshift: restricted SCC allows pods to craft custom network packets
https://notcve.org/view.php?id=CVE-2020-14336
A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allows an attacker to cause a denial of service attack on an OpenShift Container Platform cluster if they can deploy pods. The highest threat from this vulnerability is to system availability. Se ha encontrado un fallo en las Restricciones de Contexto de Seguridad (SCC), que permite a los pods diseñar paquetes de red personalizados. Este fallo permite a un atacante causar un ataque de Denegación de Servicio en un clúster de OpenShift Container Platform si pueden desplegar pods. • https://bugzilla.redhat.com/show_bug.cgi?id=1858981 https://access.redhat.com/security/cve/CVE-2020-14336 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-10743 – kibana: X-Frame-Option not set by default might lead to clickjacking
https://notcve.org/view.php?id=CVE-2020-10743
It was discovered that OpenShift Container Platform's (OCP) distribution of Kibana could open in an iframe, which made it possible to intercept and manipulate requests. This flaw allows an attacker to trick a user into performing arbitrary actions in OCP's distribution of Kibana, such as clickjacking. Se detectó que la distribución Kibana OpenShift Container Platform (OCP) podía abrirse en un iframe, lo que permitía interceptar y manipular las peticiones. Este fallo permite a un atacante engañar a un usuario para llevar a cabo acciones arbitrarias en la distribución de Kibana de OCP, como el clickjacking • https://bugzilla.redhat.com/show_bug.cgi?id=1834550 https://access.redhat.com/security/cve/CVE-2020-10743 • CWE-358: Improperly Implemented Security Check for Standard CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 0CVE-2020-1760 – ceph: header-splitting in RGW GetObject has a possible XSS
https://notcve.org/view.php?id=CVE-2020-1760
A flaw was found in the Ceph Object Gateway, where it supports request sent by an anonymous user in Amazon S3. This flaw could lead to potential XSS attacks due to the lack of proper neutralization of untrusted input. Se encontró un fallo en Ceph Object Gateway, donde admite peticiones enviadas por un usuario anónimo en Amazon S3. Este fallo podría conllevar a posibles ataques de tipo XSS debido a una falta de neutralización apropiada de una entrada no segura. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1760 https://lists.debian.org/debian-lts-announce/2021/08/msg00013.html https://lists.debian.org/debian-lts-announce/2023/10/msg00034.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P3A2UFR5IUIEXJUCF64GQ5OVLCZGODXE https://security.gentoo.org/glsa/202105-39 https://usn.ubuntu.com/4528-1 https://www.openwall.com/lists/oss-security/2020/04/07/1 https://access.redhat.com/security/cve/ • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.0EPSS: 0%CPEs: 4EXPL: 0CVE-2020-1706 – openshift/apb-tools: /etc/passwd is given incorrect privileges
https://notcve.org/view.php?id=CVE-2020-1706
It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/apb-tools-container. Se ha encontrado que en openshift-enterprise versión 3.11 y openshift-enterprise versiones 4.1 hasta 4.3 incluyéndola, múltiples contenedores modifican los permisos de /etc/passwd para que sean entonces modificables por otros usuarios diferentes de root. Un atacante con acceso al contenedor en ejecución puede explotar esto para modificar /etc/passwd para agregar un usuario y escalar sus privilegios. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1706 https://access.redhat.com/security/cve/CVE-2020-1706 https://bugzilla.redhat.com/show_bug.cgi?id=1793302 https://access.redhat.com/articles/4859371 • CWE-732: Incorrect Permission Assignment for Critical Resource •