CVSS: 8.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-1832 – Improper authorization check in the server component
https://notcve.org/view.php?id=CVE-2023-1832
An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant. Se encontró una falla de control de acceso inadecuado en Candlepin. Un atacante puede crear datos pertenecientes a otro customer/tenant, lo que puede provocar una pérdida de confidencialidad y disponibilidad para el customer/tenant afectado. • https://access.redhat.com/security/cve/CVE-2023-1832 https://bugzilla.redhat.com/show_bug.cgi?id=2184364 • CWE-284: Improper Access Control CWE-863: Incorrect Authorization •
CVSS: 7.7EPSS: 0%CPEs: 2EXPL: 0CVE-2023-3361 – S3 credentials included when exporting elyra notebook
https://notcve.org/view.php?id=CVE-2023-3361
A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output instead of an ID for a Kubernetes secret. Se encontró una falla en Red Hat OpenShift Data Science. Al exportar un pipeline desde Elyra notebook pipeline editor como Python DSL o YAML, lee las credenciales de S3 del clúster (servidor de pipeline ds) y las guarda en texto plano en la salida generada en lugar de un ID para un secreto de Kubernetes. • https://access.redhat.com/security/cve/CVE-2023-3361 https://bugzilla.redhat.com/show_bug.cgi?id=2216588 https://github.com/opendatahub-io/odh-dashboard/issues/1415 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2022-4132 – Memory leak on tls connections
https://notcve.org/view.php?id=CVE-2022-4132
A flaw was found in JSS. A memory leak in JSS requires non-standard configuration but is a low-effort DoS vector if configured that way (repeatedly hitting the login page). Se encontró una falla en JSS. Una pérdida de memoria en JSS requiere una configuración no estándar, pero es un vector DoS de bajo esfuerzo si se configura de esa manera (presionando repetidamente la página de inicio de sesión). • https://access.redhat.com/security/cve/CVE-2022-4132 https://bugzilla.redhat.com/show_bug.cgi?id=2147372 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 5.3EPSS: 0%CPEs: 8EXPL: 0CVE-2023-3153 – Service monitor mac flow is not rate limited
https://notcve.org/view.php?id=CVE-2023-3153
A flaw was found in Open Virtual Network where the service monitor MAC does not properly rate limit. This issue could allow an attacker to cause a denial of service, including on deployments with CoPP enabled and properly configured. Se encontró una falla en Open Virtual Network donde el monitor de servicio MAC no califica correctamente el límite. Este problema podría permitir que un atacante provoque una denegación de servicio, incluso en implementaciones con CoPP habilitado y configurado correctamente. • https://access.redhat.com/security/cve/CVE-2023-3153 https://bugzilla.redhat.com/show_bug.cgi?id=2213279 https://github.com/ovn-org/ovn/commit/9a3f7ed905e525ebdcb14541e775211cbb0203bd https://github.com/ovn-org/ovn/issues/198 https://mail.openvswitch.org/pipermail/ovs-announce/2023-August/000327.html https://mail.openvswitch.org/pipermail/ovs-dev/2023-August/407553.html • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.4EPSS: 0%CPEs: 2EXPL: 0CVE-2023-4586 – Hotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attack
https://notcve.org/view.php?id=CVE-2023-4586
A vulnerability was found in the Hot Rod client. This security issue occurs as the Hot Rod client does not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack. Se encontró una vulnerabilidad en el cliente Hot Rod. Este problema de seguridad ocurre porque el cliente Hot Rod no habilita la validación del nombre de host cuando usa TLS, lo que posiblemente resulte en un ataque de man-in-the-middle (MITM). • https://access.redhat.com/errata/RHSA-2023:7676 https://access.redhat.com/security/cve/CVE-2023-4586 https://bugzilla.redhat.com/show_bug.cgi?id=2235564 • CWE-20: Improper Input Validation CWE-295: Improper Certificate Validation •