PT-2020-16158 · Red Hat · Rhacm

Doran Moppert · Published 2020-11-23 · Updated 2020-12-08 · CVE-2020-25688

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions rhacm versions prior to 2.0.5 rhacm versions prior to 2.1.0

Description A flaw was found in the provisioning of internal service APIs, which were incorrectly set up using a test certificate from the source repository. This results in all installations using the same certificates. If an attacker can observe network traffic internal to a cluster, they could use the private key to decode API requests that should be protected by TLS sessions, potentially obtaining information they would not otherwise be able to. These certificates are not used for service authentication, so no opportunity for impersonation or active MITM attacks is made possible.

Recommendations For versions prior to 2.0.5, update to version 2.0.5 or later to resolve the issue. For versions prior to 2.1.0, update to version 2.1.0 or later to resolve the issue.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

CWE-321

Related Identifiers

CVE-2020-25688

Affected Products

Rhacm

References · 4

• https://osv.dev/vulnerability/CVE-2020-25688 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1892551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25688 · Security Note
• https://t.me/cibsecurity/16752 · Telegram Post