Redhat

Openshift

163 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.2

CVE-2024-2905

  • EPSS 0.02%
  • Published 25.04.2024 18:15:08
  • Last modified 29.05.2025 18:15:23

A security vulnerability has been discovered within rpm-ostree, pertaining to the /etc/shadow file in default builds having the world-readable bit enabled. This issue arises from the default permissions being set at a higher level than recommended, p...

7.7

CVE-2024-1139

  • EPSS 0.21%
  • Published 25.04.2024 17:15:47
  • Last modified 21.11.2024 08:49:52

A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.

7.5

CVE-2023-6596

  • EPSS 0.08%
  • Published 25.04.2024 16:15:10
  • Last modified 21.11.2024 08:44:10

An incomplete fix was shipped for the Rapid Reset (CVE-2023-44487/CVE-2023-39325) vulnerability for an OpenShift Containers.

9.3

CVE-2024-1485

  • EPSS 0.81%
  • Published 14.02.2024 00:15:46
  • Last modified 21.11.2024 08:50:41

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious a...

7.5

CVE-2023-44487

Warning Media report Exploit
  • EPSS 94.44%
  • Published 10.10.2023 14:15:10
  • Last modified 11.06.2025 17:29:54

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

6.3

CVE-2023-0229

  • EPSS 0.07%
  • Published 26.01.2023 21:18:06
  • Last modified 01.04.2025 15:15:57

A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-privileged users to set the seccomp profile for pods they control to "unconfined." By default, the seccomp profi...

5.3

CVE-2023-0296

  • EPSS 0.03%
  • Published 17.01.2023 21:15:15
  • Last modified 21.11.2024 07:36:55

The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy component. Even though the CVE-2016-2183 has been fixed in the etcd components, to enable periodic health checks f...

7.4

CVE-2022-3259

  • EPSS 0.08%
  • Published 09.12.2022 18:15:19
  • Last modified 22.04.2025 21:15:43

Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks.

4.8

CVE-2022-3260

Exploit
  • EPSS 0.2%
  • Published 08.12.2022 16:15:13
  • Last modified 23.04.2025 16:15:24

The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these results incorrectly, allowing clickjacking attacks.

8.1

CVE-2022-3262

  • EPSS 0.46%
  • Published 08.12.2022 16:15:13
  • Last modified 23.04.2025 16:15:24

A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. This flaw allows an attacker to supply an incorrect name with the DNS search policy, affecting confidentiality a...