CVE-2023-0056

CVE-2023-0056 affects HAProxy and is described in connected advisories as an uncontrolled resource consumption DoS that can crash the service, including a scenario where an authenticated remote attacker could trigger a crafted server in an OpenShift cluster. The issue is associated with HAProxy’s...

CVE-2022-3916

CVE-2022-3916 affects Keycloak via the offline_access scope. The flaw arises from missing root-session validation and reuse of session IDs between root and user authentication sessions, enabling an attacker to resolve a user session attached to a previously authenticated user; using the refresh t...

CVE-2023-0264

CVE-2023-0264 concerns an improper authentication flaw in Keycloak’s OpenID Connect user authentication, potentially allowing impersonation and new session token generation. The connected documents include a GitHub PoC (Exploit for Improper Authentication in Redhat Keycloak) describing a session ...

CVE-2023-3089

CVE-2023-3089 affects Red Hat OpenShift Container Platform; in OpenShift 4.13.x, the advisory RHSA-2023:4093 notes the fix for OCP in FIPS mode, stating that the CVE-3089 issue (in which not all cryptographic modules in use were FIPS-validated) is addressed by upgrading to OpenShift 4.13.5 and ap...

CVE-2023-6134

CVE-2023-6134 is a vulnerability in Keycloak-based Red Hat Single Sign-On (SSO) implementations, disclosed by OSV entries tied to RHSA advisories. The issue is a reflected XSS via a wildcard in the OIDC redirect_uri, arising from an incomplete fix for CVE-2020-10748. The connected docs confirm th...

CVE-2022-4318

CVE-2022-4318 is confirmed in multiple records as a vulnerability in cri-o that enables tampering of /etc/passwd via a specially crafted environment variable, effectively a privilege escalation path. Affected scope includes cri-o deployments used by Red Hat OpenShift platforms (OpenShift 4.x line...

CVE-2023-5625

CVE-2023-5625 describes a patch regression in Red Hat builds of python-eventlet where the CVE-2021-21419 fix was not applied across all builds/products. Connected sources confirm the issue affects python-eventlet and note a related memory-exhaustion risk via large or highly compressed websocket f...

CVE-2024-4629

The CVE-2024-4629 issue is a brute-force protection bypass in Keycloak/Red Hat Single Sign-On 7.6.10 (and related builds). A timing-based flaw lets parallel login attempts exceed configured failed-attempt limits before lockout, enabling more password guesses. Red Hat has patched this in RHSA advi...