Multiple vulnerabilities in Red Hat OpenShift GitOps 1.9

1) Resource exhaustion

EUVDB-ID: #VU82064

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-39325

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to excessive consumption of internal resources when handling HTTP/2 requests. A remote attacker can bypass the http2.Server.MaxConcurrentStreams setting by creating new connections while the current connections are still being processed, trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift GitOps: 1.9 - 1.9.2

CPE2.3

• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.2:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2023:7345

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Resource exhaustion

EUVDB-ID: #VU81728

Risk: High

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2023-44487

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improperly control of consumption for internal resources when handling HTTP/2 requests with compressed HEADERS frames. A remote attacker can send a sequence of compressed HEADERS frames followed by RST_STREAM frames and perform a denial of service (DoS) attack, a.k.a. "Rapid Reset".

Note, the vulnerability is being actively exploited in the wild.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift GitOps: 1.9 - 1.9.2

CPE2.3

• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.2:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2023:7345

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

3) OS Command Injection

EUVDB-ID: #VU72573

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-48337

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when parsing name of a source-code file in lib-src/etags.c. A remote attacker can trick the victim use the "etags -u *" command on the directory with attacker controlled content and execute arbitrary OS commands on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift GitOps: 1.9 - 1.9.2

CPE2.3

• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.2:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2023:7345

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) OS Command Injection

EUVDB-ID: #VU72575

Risk: High

CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-48339

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation within the hfy-istext-command() function when parsing the "file" and "srcdir" parameters, if a file name or directory name contains shell metacharacter. A remote attacker can execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift GitOps: 1.9 - 1.9.2

CPE2.3

• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.2:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2023:7345

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Allocation of Resources Without Limits or Throttling

EUVDB-ID: #VU82923

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-3153

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper rate limitation in the service monitor MAC. A remote attacker can perform a denial of service attack against deployments with CoPP enabled and properly configured.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift GitOps: 1.9 - 1.9.2

CPE2.3

• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.2:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2023:7345

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Information disclosure

EUVDB-ID: #VU80801

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-4641

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a local user to gain access to potentially sensitive information.

The vulnerability exists due to an error in gpasswd(1), which fails to clean memory properly. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. A local user with enough access can retrieve the password from the memory.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift GitOps: 1.9 - 1.9.2

CPE2.3

• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.2:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2023:7345

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper certificate validation

EUVDB-ID: #VU76237

Risk: Medium

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-28321

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to improper certificate validation when matching wildcards in TLS certificates for IDN names. A remote attacker crate a specially crafted certificate that will be considered trusted by the library.

Successful exploitation of the vulnerability requires that curl is built to use OpenSSL, Schannel or Gskit.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift GitOps: 1.9 - 1.9.2

CPE2.3

• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.2:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2023:7345

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper Certificate Validation

EUVDB-ID: #VU75606

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-31486

CWE-ID: CWE-295 - Improper Certificate Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to missing verification of the TLS certificate. A remote attacker can perform MitM attack and trick the application into downloading a malicious file.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift GitOps: 1.9 - 1.9.2

CPE2.3

• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.2:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2023:7345

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) External control of file name or path

EUVDB-ID: #VU81863

Risk: Low

CVSSv4.0: 0.1 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-38546

CWE-ID: CWE-73 - External Control of File Name or Path

Exploit availability: No

Description

The vulnerability allows an attacker to inject arbitrary cookies into request.

The vulnerability exists due to the way cookies are handled by libcurl. If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift GitOps: 1.9 - 1.9.2

CPE2.3

• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_openshift_gitops:1.9.2:*:*:*:*:*:*:*

External links

https://access.redhat.com/errata/RHSA-2023:7345

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.