Description
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). The Central SAML authentication ACS endpoint does not retain used SAML assertion or response identifiers to prevent replay. An attacker who obtains a valid, unexpired signed SAML response can submit it multiple times and receive distinct Central authentication tokens for the mapped identity.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10
Default version status: affected
1793184257 to < *unaffected
Red Hat Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11
Default version status: affected
1792492060 to < *unaffected