-
Notifications
You must be signed in to change notification settings - Fork 16
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Auto-Update: 2024-12-18T00:55:25.381382+00:00
- Loading branch information
1 parent
eb6374b
commit 6fa7051
Showing
4 changed files
with
166 additions
and
54 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| { | ||
| "id": "CVE-2024-10973", | ||
| "sourceIdentifier": "secalert@redhat.com", | ||
| "published": "2024-12-17T23:15:05.423", | ||
| "lastModified": "2024-12-17T23:15:05.423", | ||
| "vulnStatus": "Received", | ||
| "cveTags": [], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information." | ||
| } | ||
| ], | ||
| "metrics": { | ||
| "cvssMetricV31": [ | ||
| { | ||
| "source": "secalert@redhat.com", | ||
| "type": "Primary", | ||
| "cvssData": { | ||
| "version": "3.1", | ||
| "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", | ||
| "baseScore": 5.7, | ||
| "baseSeverity": "MEDIUM", | ||
| "attackVector": "ADJACENT_NETWORK", | ||
| "attackComplexity": "LOW", | ||
| "privilegesRequired": "LOW", | ||
| "userInteraction": "NONE", | ||
| "scope": "UNCHANGED", | ||
| "confidentialityImpact": "HIGH", | ||
| "integrityImpact": "NONE", | ||
| "availabilityImpact": "NONE" | ||
| }, | ||
| "exploitabilityScore": 2.1, | ||
| "impactScore": 3.6 | ||
| } | ||
| ] | ||
| }, | ||
| "weaknesses": [ | ||
| { | ||
| "source": "secalert@redhat.com", | ||
| "type": "Primary", | ||
| "description": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "CWE-319" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "url": "https://access.redhat.com/security/cve/CVE-2024-10973", | ||
| "source": "secalert@redhat.com" | ||
| }, | ||
| { | ||
| "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2324361", | ||
| "source": "secalert@redhat.com" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| { | ||
| "id": "CVE-2024-9779", | ||
| "sourceIdentifier": "secalert@redhat.com", | ||
| "published": "2024-12-17T23:15:05.603", | ||
| "lastModified": "2024-12-17T23:15:05.603", | ||
| "vulnStatus": "Received", | ||
| "cveTags": [], | ||
| "descriptions": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name \"cluster-manager\" which is bound to a ClusterRole also named \"cluster-manager\", which includes the permission to create Pod resources. If this deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager's token and steal any service account token by creating and mounting the target service account to control the whole cluster." | ||
| } | ||
| ], | ||
| "metrics": { | ||
| "cvssMetricV31": [ | ||
| { | ||
| "source": "secalert@redhat.com", | ||
| "type": "Primary", | ||
| "cvssData": { | ||
| "version": "3.1", | ||
| "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N", | ||
| "baseScore": 7.5, | ||
| "baseSeverity": "HIGH", | ||
| "attackVector": "NETWORK", | ||
| "attackComplexity": "HIGH", | ||
| "privilegesRequired": "NONE", | ||
| "userInteraction": "NONE", | ||
| "scope": "CHANGED", | ||
| "confidentialityImpact": "LOW", | ||
| "integrityImpact": "HIGH", | ||
| "availabilityImpact": "NONE" | ||
| }, | ||
| "exploitabilityScore": 2.2, | ||
| "impactScore": 4.7 | ||
| } | ||
| ] | ||
| }, | ||
| "weaknesses": [ | ||
| { | ||
| "source": "secalert@redhat.com", | ||
| "type": "Primary", | ||
| "description": [ | ||
| { | ||
| "lang": "en", | ||
| "value": "CWE-501" | ||
| } | ||
| ] | ||
| } | ||
| ], | ||
| "references": [ | ||
| { | ||
| "url": "https://access.redhat.com/security/cve/CVE-2024-9779", | ||
| "source": "secalert@redhat.com" | ||
| }, | ||
| { | ||
| "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317916", | ||
| "source": "secalert@redhat.com" | ||
| }, | ||
| { | ||
| "url": "https://github.com/open-cluster-management-io/ocm/pull/325", | ||
| "source": "secalert@redhat.com" | ||
| }, | ||
| { | ||
| "url": "https://github.com/open-cluster-management-io/ocm/releases/tag/v0.13.0", | ||
| "source": "secalert@redhat.com" | ||
| }, | ||
| { | ||
| "url": "https://github.com/open-cluster-management-io/registration-operator/issues/361", | ||
| "source": "secalert@redhat.com" | ||
| } | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.