4.0 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2022-27652	276		2022-04-18	2022-04-27	4.6	None	Local	Low	Not required	Partial	Partial	Partial
A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
2	CVE-2022-27650	276		2022-04-04	2022-04-13	6.0	None	Remote	Medium	???	Partial	Partial	Partial
A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
3	CVE-2022-27649	276		2022-04-04	2022-05-14	6.0	None	Remote	Medium	???	Partial	Partial	Partial
A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
4	CVE-2022-1227	269	DoS	2022-04-29	2022-05-14	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
5	CVE-2022-0711	835	DoS	2022-03-02	2022-04-22	5.0	None	Remote	Low	Not required	None	None	Partial
A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.
6	CVE-2022-0532	732		2022-02-09	2022-02-22	4.9	None	Remote	Medium	???	Partial	None	Partial
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.
7	CVE-2021-20297	20		2021-05-26	2021-06-03	2.1	None	Local	Low	Not required	None	None	Partial
A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this vulnerability is to system availability.
8	CVE-2021-20291	667	DoS	2021-04-01	2021-06-02	7.1	None	Remote	Medium	Not required	None	None	Complete
A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).
9	CVE-2021-20270	835	DoS	2021-03-23	2021-12-10	5.0	None	Remote	Low	Not required	None	None	Partial
An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
10	CVE-2021-20238	287		2022-04-01	2022-04-12	4.3	None	Remote	Medium	Not required	Partial	None	None
It was found in OpenShift Container Platform 4 that ignition config, served by the Machine Config Server, can be accessed externally from clusters without authentication. The MCS endpoint (port 22623) provides ignition configuration used for bootstrapping Nodes and can include some sensitive data, e.g. registry pull secrets. There are two scenarios where this data can be accessed. The first is on Baremetal, OpenStack, Ovirt, Vsphere and KubeVirt deployments which do not have a separate internal API endpoint and allow access from outside the cluster to port 22623 from the standard OpenShift API Virtual IP address. The second is on cloud deployments when using unsupported network plugins, which do not create iptables rules that prevent to port 22623. In this scenario, the ignition config is exposed to all pods within the cluster and cannot be accessed externally.
11	CVE-2021-3529	79	XSS	2021-06-02	2021-06-15	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
A flaw was found in noobaa-core in versions before 5.7.0. This flaw results in the name of an arbitrarily URL being copied into an HTML document as plain text between tags, including potentially a payload script. The input was echoed unmodified in the application response, resulting in arbitrary JavaScript being injected into an application's response. The highest threat to the system is for confidentiality, availability, and integrity.
12	CVE-2020-27846	115	Bypass	2020-12-21	2021-03-31	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML Authentication. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
13	CVE-2020-27827	400	DoS	2021-03-18	2021-08-04	7.1	None	Remote	Medium	Not required	None	None	Complete
A flaw was found in multiple versions of OpenvSwitch. Specially crafted LLDP packets can cause memory to be lost when allocating data to handle specific optional TLVs, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.
14	CVE-2020-27816	601		2020-12-02	2020-12-04	5.8	None	Remote	Medium	Not required	Partial	Partial	None
The elasticsearch-operator does not validate the namespace where kibana logging resource is created and due to that it is possible to replace the original openshift-logging console link (kibana console) to different one, created based on the new CR for the new kibana resource. This could lead to an arbitrary URL redirection or the openshift-logging console link damage. This flaw affects elasticsearch-operator-container versions before 4.7.
15	CVE-2020-27781	522		2020-12-18	2021-06-03	3.6	None	Local	Low	Not required	Partial	Partial	None
User credentials can be manipulated and stolen by Native CephFS consumers of OpenStack Manila, resulting in potential privilege escalation. An Open Stack Manila user can request access to a share to an arbitrary cephx user, including existing users. The access key is retrieved via the interface drivers. Then, all users of the requesting OpenStack project can view the access key. This enables the attacker to target any resource that the user has access to. This can be done to even "admin" users, compromising the ceph administrator. This flaw affects Ceph versions prior to 14.2.16, 15.x prior to 15.2.8, and 16.x prior to 16.2.0.
16	CVE-2020-25660	294		2020-11-23	2021-05-28	5.8	None	Local Network	Low	Not required	Partial	Partial	Partial
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph service via a packet sniffer and perform actions allowed by the Ceph service. This issue is a reintroduction of CVE-2018-1128, affecting the msgr2 protocol. The msgr 2 protocol is used for all communication except older clients that do not support the msgr2 protocol. The msgr1 protocol is not affected. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.
17	CVE-2020-15707	362	Exec Code Overflow Bypass	2020-07-29	2021-09-13	4.4	None	Local	Medium	Not required	Partial	Partial	Partial
Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.
18	CVE-2020-15706	362	Exec Code Bypass	2020-07-29	2021-05-01	4.4	None	Local	Medium	Not required	Partial	Partial	Partial
GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function is already executing, leading to arbitrary code execution and secure boot restriction bypass. This issue affects GRUB2 version 2.04 and prior versions.
19	CVE-2020-15705	347	Bypass	2020-07-29	2022-04-18	4.4	None	Local	Medium	Not required	Partial	Partial	Partial
GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed. This only affects systems where the kernel signing certificate has been imported directly into the secure boot database and the GRUB image is booted directly without the use of shim. This issue affects GRUB2 version 2.04 and prior versions.
20	CVE-2020-14370	212	+Info	2020-09-23	2021-11-04	4.0	None	Remote	Low	???	Partial	None	None
An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or the Docker-compatible REST API, if multiple containers are created in a short duration, the environment variables from the first container will get leaked into subsequent containers. An attacker who has control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.
21	CVE-2020-11100	787	Exec Code	2020-04-02	2020-12-24	6.5	None	Remote	Low	???	Partial	Partial	Partial
In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4, a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request, possibly causing remote code execution.
22	CVE-2020-10763	532		2020-11-24	2020-12-02	2.1	None	Local	Low	Not required	Partial	None	None
An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwords.
23	CVE-2020-10752	400		2020-06-12	2021-07-21	6.0	None	Remote	Medium	???	Partial	Partial	Partial
A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API Server panic occurred. This flaw allows an attacker with the ability to cause an API Server error to read the logs, and use the leaked OAuthToken to log into the API Server with the leaked token.
24	CVE-2020-10749			2020-06-03	2021-01-10	6.0	None	Remote	Medium	???	Partial	Partial	Partial
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.
25	CVE-2020-7013	94	Exec Code	2020-06-03	2020-06-26	6.5	None	Remote	Low	???	Partial	Partial	Partial
Kibana versions before 6.8.9 and 7.7.0 contain a prototype pollution flaw in TSVB. An authenticated attacker with privileges to create TSVB visualizations could insert data that would cause Kibana to execute arbitrary code. This could possibly lead to an attacker executing code with the permissions of the Kibana process on the host system.
26	CVE-2020-1712	416	Exec Code	2020-03-31	2022-01-28	4.6	None	Local	Low	Not required	Partial	Partial	Partial
A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.
27	CVE-2019-19353	266		2021-03-24	2021-03-26	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hive as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
28	CVE-2019-19352	266		2021-03-24	2021-03-26	4.4	None	Local	Medium	Not required	Partial	Partial	Partial
An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
29	CVE-2019-10225	522		2021-03-19	2021-03-26	6.5	None	Remote	Low	???	Partial	Partial	Partial
A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and use it to authenticate to the GlusterFS REST service, gaining access to read, and modify files.
30	CVE-2019-10200	284		2021-03-19	2021-03-26	9.0	None	Remote	Low	???	Complete	Complete	Complete
A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS IAM role, allowing management access to AWS resources. With access to the security credentials, the user then has access to the entire infrastructure. Impact to data and system availability is high.

Total number of vulnerabilities : 30 Page : 1 (This Page)