PT-2022-14038 · Red Hat · Openshift Container Platform

Avinash Hanwate · Published 2022-09-01 · Updated 2023-02-13 · CVE-2022-1677

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions OpenShift Container Platform (affected versions not specified)

Description A user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct traffic to an arbitrary application within the cluster, including one under attacker control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2022-1677

Affected Products

Openshift Container Platform

References · 7

• https://access.redhat.com/security/cve/CVE-2022-1677 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2076211 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1677 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1677 · Vendor Advisory
• https://t.me/cvenotify/35874 · Telegram Post
• https://t.me/cvenotify/44164 · Telegram Post
• https://t.me/cibsecurity/49203 · Telegram Post