CVE-2024-1139
Cluster-monitoring-operator: credentials leak
HIGH 7.7
At a glance
- Source
- NVD
- EPSS
- EPSS 0.89 % · percentile 59 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Deferred
Description
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | redhat |
| CVSS 3.1 | HIGH 7.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N | NVD · secalert@redhat.com (Secondary) |
Advisories
- GHSA-x5m7-63c6-fx79 — Withdrawn Advisory: Cluster Monitoring Operator contains a credentials leak
- GO-2024-2789 — Cluster Monitoring Operator contains a credentials leak in github.com/openshift/cluster-monitoring-operator
European references
- ENISA EUVD · EUVD-2024-1331
- GCVE · GCVE-0-2024-1139
Affected products
| Product | Versions |
|---|---|
| cluster-monitoring-operator | affected 0 ≤ 0.1.1 |
| Red Hat · Red Hat OpenShift Container Platform 4.12 | unaffected v4.12.0-202405091536.p0.g8906207.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.13 | unaffected v4.13.0-202404200313.p0.gb518881.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.gf350a68.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.gcafed17.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.gafffdd4.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.ge79d817.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.ga0733c1.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.g1a5e72f.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.g2dbe78f.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.g46dedc6.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.gd8cf3c9.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.g46dedc6.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.gad85376.assembly.stream.el9 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.g8ba0b37.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404170009.p0.g3dc363d.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.g8853e6e.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.g27f105d.assembly.stream.el8 < * |
| Red Hat · Red Hat OpenShift Container Platform 4.14 | unaffected v4.14.0-202404161544.p0.g3362d67.assembly.stream.el8 < * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |