(RHSA-2022:1040) Important: Red Hat OpenShift GitOps security update

2022-03-2321:13:36

access.redhat.com

red hat openshift

gitops

security update

admin privilege escalation

file leaking vulnerability

cve-2022-1025

cve-2022-24730

cve-2022-24731

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

40.2%

JSON

Red Hat Openshift GitOps is a declarative way to implement continuous deployment for cloud native applications.

Security Fix(es):

Openshift-Gitops: Improper access control allows admin privilege escalation (CVE-2022-1025)
argocd: path traversal and improper access control allows leaking out-of-bound files (CVE-2022-24730)
argocd: path traversal allows leaking out-of-bound files (CVE-2022-24731)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.