CVE-2022-1677
Openshift
MEDIUM 6.3
En bref
- Source
- NVD
- EPSS
- EPSS 0.60 % · centile 48 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct traffic to an arbitrary application within the cluster, including one under attacker control.
Faiblesses (CWE)
- CWE-400 — Consommation de ressources non maîtrisée (déni de service)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2022-24963
- GCVE · GCVE-0-2022-1677
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.7:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.8:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.9:*:*:*:*:*:*:*cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Openshift | affected Openshift 3.11 and 4.6 onwards |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |