Description
A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a valid API token can send deeply nested queries that cause excessive resource consumption in Central, resulting in a denial of service for the management plane.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Advanced Cluster Security 4.9
Default version status: affected
1783357116 to < *unaffected
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10
Default version status: affected
1783357140 to < *unaffected
Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.11
Default version status: affected
1783352589 to < *unaffected
Red Hat Red Hat Advanced Cluster Security 4
Default version status: affected