Fedora: Security Advisory for ocp (FEDORA-2021-64168929e4)

The remote host is missing an update for the Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 32 : adplug / audacious-plugins / ocp (2021-24ef21134b)

The remote Fedora 32 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2021-24ef21134b advisory. - An issue was discovered in AdPlug 2.3.1. There are several double-free vulnerabilities in the CEmuopl class in emuopl.cpp because of a destructor'...

CVE-2020-8563

A flaw was found in kubernetes. Clusters running on VSphere, using VSphere as a cloud provider a with logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. Mitigation Ensure that the logging level is below 4. Additionally, protect...

CVE-2020-8566

A flaw was found in kubernetes. If the logging level is to at least 4, and Ceph RBD is configured as a storage provisioner, then Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. Mitigation OCP Clusters...

Security Bulletin: Vulnerability in IBM Java Runtime affect IBM Netcool Agile Service Manager

Summary A vulnerability in IBM® Runtime Environment Java™ Version 8 used by IBM Netcool Agile Service Manager. IBM Netcool Agile Service Manager has addressed the applicable CVEs. This issue was disclosed as part of the IBM Java SDK updates in October 2019. Vulnerability Details CVEID:...

CVE-2020-1741

A flaw was found in openshift-ansible. OpenShift Container Platform OCP 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, able to man-in-the-middle the connection between the user's browser and the openshift console, could use this flaw to perfo...

CVE-2020-1741

CVE-2020-1741 affects OpenShift Container Platform 3.11 via openshift-ansible, where CORS allowed origins are configured too permissively during installation. This enables a MITM between a user’s browser and the OpenShift console to facilitate phishing, with confidentiality as the main risk. Publ...

CVE-2019-19355

An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. This CVE is specific to the openshift/ansible-operator-container as...

CVE-2019-19355

CVE-2019-19355 affects openshift/ocp-release-operator-sdk (and is tied to openshift/ansible-operator-container in OpenShift 4). The vulnerability is an insecure modification flaw in /etc/passwd that could allow an attacker with container access to modify /etc/passwd and escalate privileges. Multi...

PT-2020-10147 · Red Hat · Openshift/Ocp-Release-Operator-Sdk +2

Name of the Vulnerable Software and Affected Versions: openshift/ocp-release-operator-sdk affected versions not specified openshift/ansible-operator-container as shipped in Openshift 4 affected versions not specified Description: An insecure modification vulnerability in the /etc/passwd file was...

Insecure File Permissions

github.com/openshift/ocp-release-operator-sdk configures an insecure file permission for /etc/passwd. Any local user is able to modify the contents within the /etc/passwd file. This allows an attacker to escalate privileges by creating a new user with higher privileges and switching to the new us...

CVE-2019-19355

An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges...

CVE-2019-11324

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use o...

CVE-2018-11235

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because...

CVE-2018-1069

GlusterFS and NFS network filesystems rely on File System User ID and Group ID information in order to restrict access to file shares. However, it's possible to overwrite the Openshift restrictions on container UserId and GroupdId as they are not validated before being sent over the Openshift...

CVE-2008-5997

Absolute path traversal vulnerability in admin/fileKontrola/browser.asp in Omnicom Content Platform OCP 2.0 allows remote attackers to list arbitrary directories via a full pathname in the root parameter...

CVE-2008-5997

CVE-2008-5997: Absolute path traversal in Omnicom Content Platform (OCP) 2.0 — vulnerable code path is admin/fileKontrola/browser.asp. The root parameter can be used remotely to enumerate directories. Connected sources confirm the vulnerability and impact (directory listing/CONF disclosure); no e...

omnicom-traverse.txt

================================================================================ |||||||||||||Omnicom Content Platform Local Directory Traversal||||||||||||||||| ================================================================================...