PT-2022-21391 · Red Hat · Openshift

Sage Mctaggart · Published 2022-12-09 · Updated 2023-02-12 · CVE-2022-3259

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Openshift version 4.9

Description The issue is related to the lack of HTTP Strict Transport Security (HSTS) in Openshift, which may allow man-in-the-middle (MITM) attacks. HSTS is a security feature that helps prevent MITM attacks by ensuring that communications between a client and a server are encrypted. Without HSTS, an attacker could potentially intercept and modify traffic.

Recommendations For Openshift version 4.9, consider implementing HTTP Strict Transport Security (HSTS) to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to sensitive resources to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Improper Initialization

Weakness Enumeration

CWE-665

Related Identifiers

CVE-2022-3259

RHSA-2022:7398

RHSA-2023:1325

Affected Products

Openshift

References · 4

• https://osv.dev/vulnerability/CVE-2022-3259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3259 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2103220 · Note
• https://t.me/cibsecurity/54229 · Telegram Post