SB2023083025 - Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.3

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023083025

SB2023083025 - Multiple vulnerabilities in Multicluster Engine for Kubernetes 2.3

Published: August 30, 2023 Updated: October 25, 2024

Security Bulletin ID SB2023083025
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Inadequate Encryption Strength (CVE-ID: CVE-2023-3089)

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists within the OpenShift container platform configuration with enabled FIPS mode, which resulted in usage of not validated cryptographic modules. A remote attacker can perform various attacks against not validated cryptographic modules and gain access to sensitive information.


2) Security features bypass (CVE-ID: CVE-2023-37466)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper validation of user-supplied input within the Promise handler. A remote attacker can pass specially crafted data to the application, bypass sanitization with `@@species` accessor property to escape the sandbox and run arbitrary code.


3) Security features bypass (CVE-ID: CVE-2023-37903)

The vulnerability allows an attacker to bypass implemented security restrictions.

The vulnerability exists due to unspecified error. An attacker with code execution primitive inside the context of vm2 sandbox can use the Node.js custom inspect function to escape the sandbox and run arbitrary code.


Remediation

Install update from vendor's website.

References