CVE-2024-7128

Summary

A flaw was found in the OpenShift console. Several endpoints in the application use the authHandler() and authHandlerWithUser() middleware functions. When the default authentication provider ("openShiftAuth") is set, these functions do not perform any authentication checks, relying instead on the targeted service to handle authentication and authorization. This issue leads to various degrees of data exposure due to a lack of proper credential verification.

Affected Software

VendorProductVersion RangeStatus
4.16affected
Red HatRed Hat OpenShift Container Platform 4.16v4.16.0-202508060805.p0.gc145016.assembly.stream.el9 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.17v4.17.0-202505061536.p0.gd71a401.assembly.stream.el9 < *unaffected
Red HatRed Hat OpenShift Container Platform 4.18v4.18.0-202504300105.p0.g4294cdd.assembly.stream.el9 < *unaffected

Weaknesses

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

CVE Program Container

Additional References

References