Description
A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an attacker to bypass authentication to the Skupper console via a specially-crafted cookie.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
skupper
Default version status: unaffected
0 to < 0.0.0-20240703184342-c26bce4079ffaffected
Red Hat Service Interconnect 1.4 for RHEL 9
Default version status: affected
1.4.7-1 to < *unaffected
Red Hat Service Interconnect 1.4 for RHEL 9
Default version status: affected
1.4.7-1 to < *unaffected
Red Hat Service Interconnect 1 for RHEL 9
Default version status: affected
1.5.5-1 to < *unaffected
Red Hat Service Interconnect 1 for RHEL 9
Default version status: affected
1.5.5-1 to < *unaffected
Red Hat Red Hat Service Interconnect 1
Default version status: affected