Thom Carlin

**Nome do software vulnerável e versões afetadas** OpenShift versão 4.2 **Descrição** O problema ocorre durante a instalação de um cluster do OpenShift 4, quando a ferramenta de linha de comando `openshift-install` cria um diretório `auth`. Esse diretório contém os arquivos `kubeconfig` e `kubeadmin-password`, que armazenam as credenciais para autenticação no servidor da API do OpenShift. No entanto, esses arquivos recebem permissões incorretas de leitura, o que pode expor as credenciais. **Recomendações** Para a versão 4.2 do OpenShift, certifique-se de que os arquivos `kubeconfig` e `kubeadmin-password` tenham permissões adequadas para impedir o acesso não autorizado. Considere restringir o acesso a esses arquivos até que uma correção adequada seja aplicada. No momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Foreman versions prior to 6.2 **Description** The issue allows local users with access to the system journal to obtain the root password by reading the system journal or by clicking Logs on the console, when the ssh service has been enabled on discovered nodes and discovery-debug is used to log in. This occurs because the root password is displayed in plaintext in the system journal. **Recommendations** For versions prior to 6.2, consider disabling the ssh service on discovered nodes or restricting access to the system journal to minimize the risk of exploitation. As a temporary workaround, avoid using the discovery-debug feature until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Red Hat QuickStart Cloud Installer (QCI) versions prior to 1.0 GA **Description** The issue concerns a file, `/var/lib/ovirt-engine/setup/engine-DC-config.py`, created by Red Hat QuickStart Cloud Installer (QCI) that is world readable and contains the root password of the deployed system. **Recommendations** For versions prior to 1.0 GA, update to version 1.0 GA or later to resolve the issue. As a temporary workaround, consider changing the permissions of the `/var/lib/ovirt-engine/setup/engine-DC-config.py` file to restrict read access.

**Name of the Vulnerable Software and Affected Versions** Red Hat QuickStart Cloud Installer (QCI) (affected versions not specified) **Description** The issue concerns the Red Hat QuickStart Cloud Installer (QCI) using world-readable permissions for the /etc/qci/answers file. This allows local users to obtain the root password for the deployed system by reading the file. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foreman versions prior to 1.11.4 Foreman versions 1.12.x prior to 1.12.1 **Description** The issue allows remote authenticated users with permission to view some hosts to obtain sensitive host configuration information. This is possible because access to preview provisioning templates is not properly restricted. **Recommendations** For Foreman versions prior to 1.11.4, update to version 1.11.4 or later. For Foreman versions 1.12.x prior to 1.12.1, update to version 1.12.1 or later.