CVE-2024-6535: falha de média gravidade em skupper
Skupper: potential authentication bypass to skupper console via forged cookies
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.5%
A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an attacker to bypass authentication to the Skupper console via a specially-crafted cookie.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
skupperRed Hat · Red Hat Service Interconnect 1Red Hat · Service Interconnect 1.4 for RHEL 9Red Hat · Service Interconnect 1 for RHEL 9CVEs relacionadas — skupper
No mesmo produto, das mais perigosas para as menos.
CVE-2024-1394HIGHGolang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsEPSS 1.5%CVE-2024-12582HIGHSkupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of serviceEPSS 0.5%CVE-2024-9355MEDIUMGolang-fips: golang fips zeroed bufferEPSS 0.3%