Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2024-5037

Openshift/telemeter: iss check during jwt authentication can be bypassed

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON web token (JWT) authentication.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

telemeter

Default version status: unaffected

  • 4.16 to < 4.17affected

Red Hat Red Hat OpenShift Container Platform 4.12

Default version status: affected

  • v4.12.0-202408071159.p0.gc9592de.assembly.stream.el8 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.13

Default version status: affected

  • v4.13.0-202407081338.p0.g0634a6d.assembly.stream.el8 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.14

Default version status: affected

  • v4.14.0-202407021509.p0.g1f72681.assembly.stream.el8 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.15

Default version status: affected

  • v4.15.0-202406200537.p0.g14489f7.assembly.stream.el9 to < *unaffected

Red Hat Red Hat OpenShift Container Platform 4.16

Default version status: affected

  • v4.16.0-202406200537.p0.gc1ecd10.assembly.stream.el9 to < *unaffected

Red Hat Logging Subsystem for Red Hat OpenShift

Default version status: unaffected

Red Hat Red Hat OpenShift distributed tracing 2

Default version status: affected

Red Hat Red Hat OpenShift distributed tracing 3

Default version status: affected

References