VDB
RHSA-2023%3A0237
RHSA-2023%3A0237
PUBLISHED
CVSS 9.100000381469727 CRITICAL
An authentication bypass flaw was discovered in the crewjam/saml go package. A remote unauthenticated attacker could trigger it by sending a SAML request. This would allow an escalation of privileges and then enable compromising system integrity.
Risk Scores
CVSS 3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-grafana@sha256:d0891ea0ae083a46658a4ba8fdc086925f5f2f9fe8b0c0a9d81032a5d54dc792_s390x as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-grafana@sha256:d0891ea0ae083a46658a4ba8fdc086925f5f2f9fe8b0c0a9d81032a5d54dc792_s390x |
| Red Hat | openshift4/ose-csi-driver-nfs-rhel8@sha256:aa647a1187e323428f9cfec67277f50e3d76e29e81771f5905ed943e6cbb218b_amd64 as a component of Red Hat OpenShift Container Platform 4.8 | * |
| Red Hat | openshift4/ose-jenkins-agent-maven@sha256:21d588ce299fe7d35fba47e681851b6e9dcc88dedbc45980edd4e3af6506c31c_amd64 as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-jenkins-agent-maven@sha256:21d588ce299fe7d35fba47e681851b6e9dcc88dedbc45980edd4e3af6506c31c_amd64 |
| Red Hat | openshift4/ose-jenkins-agent-base@sha256:13227bfe24c5711ffef3f4c2399e8978c481685a9152c56bb96f650632aa9927_s390x as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-jenkins-agent-base@sha256:13227bfe24c5711ffef3f4c2399e8978c481685a9152c56bb96f650632aa9927_s390x |
| Red Hat | openshift4/ose-jenkins-agent-maven@sha256:a9b82f17d2c8ca2429ca52f763b581243231abfed5068a61fb197a23187a7ae7_ppc64le as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-jenkins-agent-maven@sha256:a9b82f17d2c8ca2429ca52f763b581243231abfed5068a61fb197a23187a7ae7_ppc64le |
| Red Hat | openshift4/ose-jenkins-agent-nodejs-12-rhel8@sha256:9c7427d561e71f7e1b09b40126f0f374ca201dc6582f362a1bb525746d947324_ppc64le as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-jenkins-agent-nodejs-12-rhel8@sha256:9c7427d561e71f7e1b09b40126f0f374ca201dc6582f362a1bb525746d947324_ppc64le |
| Red Hat | openshift4/ose-grafana@sha256:fac1f97c5bd6c9daf34994071358e7550e7d21627d5648283f56ec779be7f210_ppc64le as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-grafana@sha256:fac1f97c5bd6c9daf34994071358e7550e7d21627d5648283f56ec779be7f210_ppc64le |
| Red Hat | openshift4/ose-jenkins@sha256:5cec50c1e0ab2731f85c6811fd444b0221bdba02054e9f20ba4144366fc9e978_amd64 as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-jenkins@sha256:5cec50c1e0ab2731f85c6811fd444b0221bdba02054e9f20ba4144366fc9e978_amd64 |
| Red Hat | openshift4/ose-jenkins@sha256:f6f681d7ec91368dba253b73919d85e2f36e019b0a5e6055200601017fcf85dc_ppc64le as a component of Red Hat OpenShift Container Platform 4.8 | * |
| Red Hat | openshift4/ose-ironic-machine-os-downloader-rhel8@sha256:27ed39eed72478f2312cfa7b3d997a19bcfb4b39720505aee11134f6ab55c4cb_amd64 as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-ironic-machine-os-downloader-rhel8@sha256:27ed39eed72478f2312cfa7b3d997a19bcfb4b39720505aee11134f6ab55c4cb_amd64 |
| Red Hat | openshift4/ose-baremetal-installer-rhel8@sha256:0a8a54bb1cd66888e5f77fac300e5860536b7922ab892039f414a1c2ee432d87_amd64 as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-baremetal-installer-rhel8@sha256:0a8a54bb1cd66888e5f77fac300e5860536b7922ab892039f414a1c2ee432d87_amd64 |
| Red Hat | openshift4/ose-baremetal-installer-rhel8@sha256:db716b32e3e15cbebb247ca1ae4fb9eef83dd43aef3789ecd4ad1022a772476c_s390x as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-baremetal-installer-rhel8@sha256:db716b32e3e15cbebb247ca1ae4fb9eef83dd43aef3789ecd4ad1022a772476c_s390x |
| Red Hat | openshift4/ose-jenkins@sha256:820ef59cfcf987a19e35de7ede4c7de67e7c4bb37c4e1408de07569281427567_s390x as a component of Red Hat OpenShift Container Platform 4.8 | * |
| Red Hat | openshift4/ose-jenkins-agent-nodejs-12-rhel8@sha256:be0ff39c51d75c5864467d4707c6cad1aa574c13ff7a3b57116485a7269093f8_s390x as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-jenkins-agent-nodejs-12-rhel8@sha256:be0ff39c51d75c5864467d4707c6cad1aa574c13ff7a3b57116485a7269093f8_s390x |
| Red Hat | openshift4/ose-ironic-static-ip-manager-rhel8@sha256:4b9989e1b78987900fa94ba0c95f90e52738e88f49be00dee6875bd09107300a_ppc64le as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-ironic-static-ip-manager-rhel8@sha256:4b9989e1b78987900fa94ba0c95f90e52738e88f49be00dee6875bd09107300a_ppc64le |
| Red Hat | openshift4/ose-baremetal-installer-rhel8@sha256:20818730ffc46142a8545ddbe8cb9033487988cf5cd5777d3b1ecc6d2a484a36_ppc64le as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-baremetal-installer-rhel8@sha256:20818730ffc46142a8545ddbe8cb9033487988cf5cd5777d3b1ecc6d2a484a36_ppc64le |
| Red Hat | openshift4/ose-jenkins-agent-nodejs-12-rhel8@sha256:218fd07aca9fc09c95260effb9867adda47447fb4b5e980d27a968af6bdbe6f2_amd64 as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-jenkins-agent-nodejs-12-rhel8@sha256:218fd07aca9fc09c95260effb9867adda47447fb4b5e980d27a968af6bdbe6f2_amd64 |
| Red Hat | openshift4/ose-grafana@sha256:87530ea65e26d9454842e04a232a9ec21da9ab381c3eb31e53146a2c22a3c0fb_amd64 as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-grafana@sha256:87530ea65e26d9454842e04a232a9ec21da9ab381c3eb31e53146a2c22a3c0fb_amd64 |
| Red Hat | openshift4/ose-jenkins-agent-maven@sha256:31f7f5bc4b51d8ec351eb30c56d1d95790973ff712a75973d67d83dc06d2abb7_s390x as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-jenkins-agent-maven@sha256:31f7f5bc4b51d8ec351eb30c56d1d95790973ff712a75973d67d83dc06d2abb7_s390x |
| Red Hat | openshift4/ose-ironic-machine-os-downloader-rhel8@sha256:b60c6cd6b2b29aad189113d18f041f462eed503f1683c6bf409ff7637c551284_ppc64le as a component of Red Hat OpenShift Container Platform 4.8 | openshift4/ose-ironic-machine-os-downloader-rhel8@sha256:b60c6cd6b2b29aad189113d18f041f462eed503f1683c6bf409ff7637c551284_ppc64le |
…and 4 more
Timeline
- Jan 25, 2023 CVE Published
- Mar 21, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2023:0237 advisory
- https://access.redhat.com/security/updates/classification/#important advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2149181 issue
- https://issues.redhat.com/browse/OCPBUGS-5964 advisory
- https://issues.redhat.com/browse/OCPBUGS-5965 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0237.json advisory
- https://access.redhat.com/security/cve/CVE-2022-41912 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-41912 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-41912 advisory
- https://github.com/crewjam/saml/security/advisories/GHSA-j2jp-wvqg-wc2g advisory