CVE-2022-2403

CWE-497CWE-668 — Exposure to Wrong Sphere4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.2%
top 52.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Openshift
Timeline
PublishedSep 1
Latest updateSep 2

Description

A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps, and accessible to any authenticated OpenShift user or service-account. A malicious user could exploit this flaw by reading the oauth-serving-cert ConfigMap in the openshift-config-managed namespace, compromising any web traffic secured using that certificate.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5openshiftOpenshift 4.9 onwards

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-w6cm-9c76-c988: A credentials leak was found in the OpenShift Container Platform↗2022-09-02
▶
CVEList
CVE-2022-2403: A credentials leak was found in the OpenShift Container Platform↗2022-09-01
▶

📋Vendor Advisories

1
Red Hat
openshift: oauth-serving-cert configmap contains cluster certificate private key↗2022-06-28
▶