CVE-2020-1741
published 2020-04-24CVE-2020-1741: A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during…
PriorityP428medium5.9CVSS 3.1
AVNACHPRNUIRSUCHILAN
EPSS
0.85%
54.5th percentile
A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, able to man-in-the-middle the connection between the user's browser and the openshift console, could use this flaw to perform a phishing attack. The main threat from this vulnerability is data confidentiality.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| red_hat | openshift-ansible | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
nvdv2.04.0MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:N
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
openshift-ansible: cors allowed origin allows changing url protocol
vendor_redhat·2020-03-13·CVSS 5.9
CVE-2020-1741 [MEDIUM] CWE-185 openshift-ansible: cors allowed origin allows changing url protocol
openshift-ansible: cors allowed origin allows changing url protocol
A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, able to man-in-the-middle the connection between the user's browser and the openshift console, could use this flaw to perform a phishing attack. The main threat from this vulnerability is data confidentiality.
A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, able to man-in-the-middle the connection between the user's browser and the openshift console, could use this flaw to perform a phishing attack. The main threat from th
GHSA
GHSA-wqfw-39gh-42cj: A flaw was found in openshift-ansible
ghsa_unreviewed·2022-05-24
CVE-2020-1741 [MEDIUM] CWE-185 GHSA-wqfw-39gh-42cj: A flaw was found in openshift-ansible
A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, able to man-in-the-middle the connection between the user's browser and the openshift console, could use this flaw to perform a phishing attack. The main threat from this vulnerability is data confidentiality.
Kernel
vt: selection, close sel_buffer race
kernel_security·2020-02-10·CVSS 7.1
CVE-2020-8648 [HIGH] vt: selection, close sel_buffer race
vt: selection, close sel_buffer race
syzkaller reported this UAF:
BUG: KASAN: use-after-free in n_tty_receive_buf_common+0x2481/0x2940 drivers/tty/n_tty.c:1741
Read of size 1 at addr ffff8880089e40e9 by task syz-executor.1/13184
CPU: 0 PID: 13184 Comm: syz-executor.1 Not tainted 5.4.7 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
...
kasan_report+0xe/0x20 mm/kasan/common.c:634
n_tty_receive_buf_common+0x2481/0x2940 drivers/tty/n_tty.c:1741
tty_ldisc_receive_buf+0xac/0x190 drivers/tty/tty_buffer.c:461
paste_selection+0x297/0x400 drivers/tty/vt/selection.c:372
tioclinux+0x20d/0x4e0 drivers/tty/vt/vt.c:3044
vt_ioctl+0x1bcf/0x28d0 drivers/tty/vt/vt_ioctl.c:364
tty_ioctl+0x525/0x15a0 drivers/tty/tty_io.c:2657
vfs_ioctl fs/ioctl.c:47 [inline]
I
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-27767 ImageMagick: outside the range of representable values of type 'float' at MagickCore/quantum.h
bugzilla·2020-11-04·CVSS 3.3
CVE-2020-27767 [LOW] CVE-2020-27767 ImageMagick: outside the range of representable values of type 'float' at MagickCore/quantum.h
CVE-2020-27767 ImageMagick: outside the range of representable values of type 'float' at MagickCore/quantum.h
In ImageMagick, there are an outside the range of representable values of type 'float' at MagickCore/quantum.h:87 and outside the range of representable values of type 'unsigned char' at MagickCore/quantum.h.
Reference:
https://github.com/ImageMagick/ImageMagick/issues/1741
Upstream patch:
https://github.com/ImageMagick/ImageMagick/commit/564f2a35e523e2b6cce9485018157f03ec05a947
Discussion:
Acknowledgments:
Name: Suhwan Song (Seoul National University)
---
Statement:
This flaw is out of support scope for Red Hat Enterprise Linux 5, 6, and 7. Inkscape is not affected because it no longer uses a bundled ImageMagick in Red Hat Enterprise Linux 8. For more information regardin
Bugzilla
CVE-2020-1741 openshift-ansible: cors allowed origin allows changing url protocol
bugzilla·2020-02-13·CVSS 5.9
CVE-2020-1741 [MEDIUM] CVE-2020-1741 openshift-ansible: cors allowed origin allows changing url protocol
CVE-2020-1741 openshift-ansible: cors allowed origin allows changing url protocol
OpenShift Container Platform (OCP) 3.11 was too permissive in the way it specified CORS allowed origins during installation. An attacker able to man-in-the-middle the connection between the user's browser and the openshift console could use this flaw to perform a phishing attack.
Discussion:
Mitigation:
Ensure that the corsAllowedOrigin definition within master-config.yaml contains elements in the form
~~~
corsAllowedOrigins:
- ^(?i)https://my\.subdomain\.domain\.com(:|\z)
~~~
and not the form
~~~
corsAllowedOrigins:
- (?i)//my\.subdomain\.domain\.com(:|\z)
~~~
as the first will permit cross origin requests only if the host and protocol matches, whereas the second will permit a downgrade to http proto
2020-04-24
Published