CVE-2020-25688: redhat advanced_cluster_management_for_kubernetes Use of Hard-coded Cryptographic Key

Vulnerability summary

CVE-2020-25688 is a low (CVSS 3.5) Use of Hard-coded Cryptographic Key vulnerability in redhat advanced_cluster_management_for_kubernetes. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.4% of scored vulnerabilities.

Timeline

1. 23-11-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a cluster, they could use the private key to decode API requests that should be protected by TLS sessions, potentially obtaining information they would not otherwise be able to. These certificates are not used for service authentication, so no opportunity for impersonation or active MITM attacks were made possible.

• CWE-321Use of Hard-coded Cryptographic KeyThe product uses a hard-coded, unchangeable cryptographic key.
• CWE-798Use of Hard-coded CredentialsThe product contains hard-coded credentials, such as a password or cryptographic key.