Lucene search

RedhatCVE-2020-27836

HistoryAug 22, 2022 - 3:15 p.m.

CVE-2020-27836

2022-08-2215:15:12

CWE-732

redhat

web.nvd.nist.gov

cve-2020-27836

cluster-ingress-operator

vulnerability

unauthorized access

data confidentiality

data integrity

system availability

nvd.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

58.7%

JSON

A flaw was found in cluster-ingress-operator. A change to how the router-default service allows only certain IP source ranges could allow an attacker to access resources that would otherwise be restricted to specified IP ranges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability…

Affected configurations

Nvd

Vulners

Node

redhatenterprise_linuxMatch8.0

AND

redhatopenshift_container_platformMatch4.6

VendorProductVersionCPE
redhatenterprise_linux8.0cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
redhatopenshift_container_platform4.6cpe:2.3:a:redhat:openshift_container_platform:4.6:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	enterprise_linux	8.0	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
redhat	openshift_container_platform	4.6	cpe:2.3:a:redhat:openshift_container_platform:4.6:::::::*

CNA Affected

[
  {
    "product": "cluster-ingress-operator",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in ose-cluster-ingress-operator-container-v4.6.0-202012161211.p0."
      }
    ]
  }
]

References

access.redhat.com/security/cve/CVE-2020-27836

bugzilla.redhat.com/show_bug.cgi?id=1905490

bugzilla.redhat.com/show_bug.cgi?id=1906267

github.com/openshift/cluster-ingress-operator/pull/507/commits/92c83f281ba5fb6a1d91ecc3beaa4bcf2647a729

Social References

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.2

Confidence

High

EPSS

0.002

Percentile

58.7%

JSON

Related for CVE-2020-27836