Lucene search

GoogleOSV:GO-2024-2789

HistoryJun 05, 2024 - 3:10 p.m.

Cluster Monitoring Operator contains a credentials leak in github.com/openshift/cluster-monitoring-operator

2024-06-0515:10:52

Google

osv.dev

cluster monitoring

credentials leak

github

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

Percentile

10.3%

JSON

Cluster Monitoring Operator contains a credentials leak in github.com/openshift/cluster-monitoring-operator

References

access.redhat.com/errata/RHSA-2024:1887

access.redhat.com/errata/RHSA-2024:1891

access.redhat.com/errata/RHSA-2024:2047

access.redhat.com/errata/RHSA-2024:2782

access.redhat.com/security/cve/CVE-2024-1139

bugzilla.redhat.com/show_bug.cgi?id=2262158

github.com/advisories/GHSA-x5m7-63c6-fx79

github.com/openshift/cluster-monitoring-operator/blob/d45a3335c2bbada0948adef9fcba55c4e14fa1d7/pkg/manifests/manifests.go#L3135

github.com/openshift/cluster-monitoring-operator/commit/1cfbe9ffafe1e43f8f87a451b72fddf5d76fa4e3

github.com/openshift/cluster-monitoring-operator/pull/1747

nvd.nist.gov/vuln/detail/CVE-2024-1139

CVSS3

7.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

Percentile

10.3%

JSON

Related for OSV:GO-2024-2789