Openshift api admission checks does not enforce "custom-host" permissions
Published Oct 5, 2023
7.5
HIGHCVSS 3.1
EPSS 0.40%
Description
A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.
Affected products
-
-
- Vendor n/a Product Kubernetes Defaultaffected
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||
|---|---|---|---|---|---|---|
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2 | affected |
| |||
| Red Hat | Red Hat OpenShift Container Platform 4 | affected |
| |||
| n/a | Kubernetes | affected |
|
- 2.0
- 4.0
No data.
Red Hat Advanced Cluster Management for Kubernetes 2
rhacm2/agent-service-rhel8
Affected
Red Hat Ansible Automation Platform 1.2
kubernetes
Not affected
Red Hat Ansible Tower 3
kubernetes
Not affected
Red Hat OpenShift Container Platform 3.11
atomic-openshift
Out of support scope
Red Hat OpenShift Container Platform 4
openshift
Fix deferred
Red Hat OpenShift Container Platform 4
openshift-clients
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/agent-service-rhel8 | Affected | n/a |
| Red Hat Ansible Automation Platform 1.2 | kubernetes | Not affected | n/a |
| Red Hat Ansible Tower 3 | kubernetes | Not affected | n/a |
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift | Out of support scope | n/a |
| Red Hat OpenShift Container Platform 4 | openshift | Fix deferred | n/a |
| Red Hat OpenShift Container Platform 4 | openshift-clients | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (4)
- https://access.redhat.com/security/cve/CVE-2022-3248 vdb-entryx_refsource_REDHATVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2072188 issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-3248
- https://www.cve.org/CVERecord?id=CVE-2022-3248
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2022-3248 | vdb-entryx_refsource_REDHATVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2072188 | issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2022-3248 | ||
| https://www.cve.org/CVERecord?id=CVE-2022-3248 |
Change history (0)
No recorded changes yet.