#VU63885 Man-in-the-Middle (MitM) attack in Red Hat OpenShift Container Platform - CVE-2022-1677

Vulnerability identifier: #VU63885

Vulnerability risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-1677

CWE-ID: CWE-300

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Red Hat OpenShift Container Platform
Client/Desktop applications / Software for system administration

Vendor: Red Hat Inc.

Description

The vulnerability allows a remote user to perform MitM attack.

The vulnerability exists due to an error when handling entries in cluster router's HAProxy configuration files. A remote user with permissions to create or modify Routes can insert a malformed entry into configuration files that match any arbitrary hostname or all hostnames in the cluster, and direct traffic to an arbitrary application within the cluster, including the application under attacker's control.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Red Hat OpenShift Container Platform: 3.11.0 - 3.11.685, 4.6.0 - 4.6.57, 4.7.0 - 4.7.50, 4.8.0 - 4.8.39, 4.9.0 - 4.9.33, 4.10.0 - 4.10.12

---

External links
https://bugzilla.redhat.com/show_bug.cgi?id=2076211

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.