📦 Openshift Container Platform

Keycloak has a cross-site scripting (XSS) vulnerability in SAML and OIDC providers where attackers can inject malicious scripts via AssertionConsumerServiceURL or redirect_uri parameters. This allows ...

CVE-2020-27846 is a signature verification vulnerability in the crewjam/saml library that allows attackers to bypass SAML authentication. This affects any application using vulnerable versions of this...

A heap-based buffer overflow vulnerability in glib's g_escape_uri_string() function allows attackers to write beyond allocated memory boundaries when processing strings with many characters requiring ...

A type confusion vulnerability in libxslt's psvi memory field allows attackers to crash applications or corrupt memory during XML transformations. This affects any software using vulnerable libxslt ve...

This vulnerability in libssh allows an authenticated remote attacker to trigger an out-of-bounds read in the sftp_handle function, potentially exposing sensitive memory contents or affecting service b...

This CVE describes an integer overflow vulnerability in libxml2's xmlBuildQName function that can cause stack-based buffer overflow when processing malicious XML input. This vulnerability affects any ...

This CVE describes an integer overflow vulnerability in libarchive's RAR handling function that leads to a double-free condition. Attackers can exploit this to execute arbitrary code or cause denial-o...

A heap-based buffer overflow vulnerability in grub2's squash4 filesystem module allows attackers to execute arbitrary code by crafting malicious filesystems. This affects systems using grub2 with squa...

This vulnerability in the HFS filesystem driver allows attackers to trigger a heap-based buffer overflow by providing a specially crafted volume name. This could lead to arbitrary code execution in GR...

This vulnerability in rsync allows attackers to leak uninitialized stack memory one byte at a time by manipulating checksum length during file comparison. It affects systems using vulnerable rsync ver...

This vulnerability in Buildah allows attackers to bypass path validation in cache mounts, enabling arbitrary host directory access during container builds. Users running Buildah with untrusted Contain...

This vulnerability in Podman allows attackers to create malicious containers that exhaust system memory through IPC resource exhaustion. When containers share IPC namespaces, a malicious container can...

This vulnerability in OpenShift's Telemeter allows attackers to bypass JWT authentication by using forged tokens that evade issuer validation checks. It affects OpenShift environments using Telemeter ...

This vulnerability in Keycloak allows attackers to bypass URL validation in redirects when clients use wildcards in Valid Redirect URIs. Attackers can construct malicious requests to access unauthoriz...

This vulnerability in Keycloak's redirect_uri validation logic allows attackers to bypass host restrictions and steal access tokens. Attackers can then impersonate legitimate users. All Keycloak deplo...

An unconstrained memory consumption vulnerability in Keycloak allows attackers to cause denial of service by triggering excessive resource usage when accessing the admin UI's consents tab in environme...

CVE-2023-5408 is a privilege escalation vulnerability in OpenShift's Kubernetes API server node restriction admission plugin. A remote attacker who can modify node role labels could redirect workloads...

CVE-2023-44487 is an HTTP/2 protocol vulnerability that allows attackers to cause denial of service by rapidly resetting streams, consuming server resources. This affects any system using HTTP/2, incl...

This vulnerability in Open vSwitch allows ICMPv6 Neighbor Advertisement packets to bypass OpenFlow rules between virtual machines. A local attacker can craft packets with spoofed target IP addresses t...

CVE-2023-1260 is an authentication bypass vulnerability in Kubernetes kube-apiserver that allows authenticated attackers with specific permissions to bypass Security Context Constraints (SCC) admissio...

This vulnerability in Quarkus allows attackers to bypass HTTP security policies by using specially crafted character permutations in requests. Affected systems could experience unauthorized access to ...

CVE-2023-1108 is a denial-of-service vulnerability in Undertow's SSL/TLS implementation where an infinite loop in the handshake process can crash the server. This affects any system running vulnerable...

This CVE describes a compliance issue in Red Hat OpenShift Container Platform where, when FIPS mode is enabled, not all cryptographic modules used are FIPS-validated. This affects organizations using ...

CVE-2021-3697 is a heap buffer underflow vulnerability in GRUB2's JPEG parser that allows a crafted JPEG image to corrupt heap memory. Successful exploitation could lead to arbitrary code execution or...

This vulnerability in CRI-O allows attackers with Kube API access to cause memory or disk space exhaustion on Kubernetes nodes by executing commands that generate large output. The issue occurs when C...

CVE-2022-1227 is a privilege escalation vulnerability in Podman that allows attackers to gain host filesystem access when users run 'podman top' on malicious container images. This affects Podman user...

This vulnerability in Podman and Moby (Docker Engine) allows containers to start with non-empty inheritable Linux process capabilities. An attacker with access to programs having inheritable file capa...

CVE-2021-3609 is a race condition vulnerability in the Linux kernel's CAN BCM networking protocol that allows local attackers to corrupt memory and potentially escalate privileges to root. This affect...

CVE-2022-0711 is a denial-of-service vulnerability in HAProxy where specially crafted HTTP responses containing Set-Cookie2 headers can trigger an infinite loop, causing the service to become unrespon...

CVE-2021-3560 is a privilege escalation vulnerability in polkit's D-Bus authentication mechanism that allows unprivileged local users to bypass credential checks and gain root privileges. This affects...

CVE-2021-4104 is a deserialization vulnerability in Log4j 1.2's JMSAppender that allows remote code execution when attackers can modify Log4j configuration files. This affects systems running Log4j 1....

This vulnerability allows an attacker with access to a container running the vulnerable operator-framework/presto component in Red Hat OpenShift 4 to modify the /etc/passwd file, potentially leading t...

This vulnerability allows attackers with access to a container running the operator-framework/hadoop in Red Hat OpenShift 4 to modify the /etc/passwd file, potentially enabling privilege escalation. I...

This vulnerability in Pygments' SMLLexer causes an infinite loop when processing Standard ML source files containing only the 'exception' keyword, leading to denial of service. It affects systems usin...

This vulnerability allows authenticated OpenShift users who can execute code during container build time to access credentials that are automatically mounted into the build container. They can then us...

This vulnerability in fabric8 kubernetes-client allows malicious pods/containers to exploit the copy command to extract files outside the intended working directory path. Applications using the vulner...

This CVE-2019-11253 vulnerability in Kubernetes allows authorized users to send malicious YAML or JSON payloads to the API server, causing excessive CPU or memory consumption that can crash the server...

This CVE describes a heap-buffer-overflow vulnerability in GnuTLS's certtool utility when parsing template files. An attacker can trigger memory corruption leading to denial-of-service (system crash)....

A heap-buffer-overread vulnerability in GnuTLS allows attackers to create malicious certificates with malformed Certificate Transparency extensions that leak sensitive information during certificate v...

A vulnerability in libssh versions built with OpenSSL <3.0 causes the ssh_kdf() function to incorrectly report successful key derivation when it actually fails. This leads to uninitialized cryptograph...

This vulnerability in systemd-coredump allows attackers to exploit a race condition to access privileged process coredumps. By forcing a SUID process to crash and replacing it before systemd-coredump ...

A stack overflow vulnerability in GRUB2's BFS filesystem parser allows an attacker to crash the bootloader by providing a specially crafted BFS filesystem. This affects systems using GRUB2 with BFS su...

This OpenSSH vulnerability allows machine-in-the-middle attacks when VerifyHostKeyDNS is enabled. Attackers can impersonate legitimate servers by exploiting error code mishandling during host key veri...

A path traversal vulnerability in rsync's --safe-links option allows attackers to write files outside intended directories when the client fails to properly verify nested symbolic links from the serve...

This rsync vulnerability allows a malicious server to read arbitrary files from a client's machine during file transfer operations. Attackers can reconstruct file contents byte-by-byte by sending spec...

This CVE describes a denial-of-service vulnerability in OpenShift's GraphQL batching functionality. Attackers can send requests containing thousands of aliases in a single query, causing excessive res...

A symlink traversal vulnerability in the containers/storage library used by Podman, Buildah, and CRI-O allows malicious container images to cause denial of service via OOM kill. Attackers can exploit ...

This vulnerability in Go's containers/common library allows attackers to exploit symbolic links when FIPS mode is enabled, potentially mounting sensitive host directories inside containers. This bypas...

CVE-2022-1274 is an HTML injection vulnerability in Keycloak's execute-actions-email endpoint that allows attackers to inject arbitrary HTML into emails sent to users. This affects all Keycloak deploy...

An uncontrolled resource consumption vulnerability in HAProxy could allow an authenticated remote attacker to crash the service by running a specially crafted malicious server in an OpenShift cluster....