CveMateVulnerability intelligence

Openshift vulnerabilities

7 vulnerabilities

Known vulnerabilities in Openshift products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 5 products.

Products

5

Openshift2 vulnerabilities
Origin2 vulnerabilities
Openshift Enterprise1 vulnerabilities
Openshift/Openshift Apiserver1 vulnerabilities
OSIN1 vulnerabilities

CVE-2013-0196openshiftopenshift enterprise+1816y ago30-12-2019 21:17

A CSRF issue was found in OpenShift Enterprise 1.2. The web console is using 'Basic authentication' and the REST API has no CSRF attack protection mechanism. This can allow an attacker to obtain the credential and the Authorization: header when requesting the REST API via web browser.CVE-2021-4294github.com/openshiftosin+33y ago28-12-2022 16:51

A vulnerability was found in OpenShift OSIN. It has been classified as problematic. This affects the function ClientSecretMatches/CheckClientSecret. The manipulation of the argument secret leads to observable timing discrepancy. The name of the patch is 8612686d6dda34ae9ef6b5a974e4b7accb4fea29. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216987.CVE-2015-8945openshiftorigin10y ago05-08-2016 15:00

openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive private key information by reading the systemd journal.CVE-2015-3207github.com/openshiftorigin+14y ago07-07-2022 12:25

In Openshift Origin 3 the cookies being set in console have no 'secure', 'HttpOnly' attributes.CVE-2020-10752openshiftopenshift/openshift-apiserver+16y ago12-06-2020 22:09

A flaw was found in the OpenShift API Server, where it failed to sufficiently protect OAuthTokens by leaking them into the logs when an API Server panic occurred. This flaw allows an attacker with the ability to cause an API Server error to read the logs, and use the leaked OAuthToken to log into the API Server with the leaked token.CVE-2014-0163openshiftopenshift+16y ago11-12-2019 15:33

Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.CVE-2014-0023openshiftopenshift+16y ago15-11-2019 14:40

OpenShift: Install script has temporary file creation vulnerability which can result in arbitrary code execution