VDB
RHSA-2023%3A2110
RHSA-2023%3A2110
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in exporter-toolkit. A request can be forged by an attacker to poison the internal cache used to cache hashes and make subsequent successful requests. This cache is used to limit side channel attacks that could tell an attacker if a user is present in the file or not. Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication. Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password. However, due to the way this mechanism was implemented in the exporter toolkit, if the hashed password is known, it is possible to authenticate against Prometheus.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-k8s-prometheus-adapter@sha256:cb792d85373296417331109af821dee2ae6bfbab0b4049697fa33ae5180fe2b7_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-k8s-prometheus-adapter@sha256:cb792d85373296417331109af821dee2ae6bfbab0b4049697fa33ae5180fe2b7_amd64 |
| Red Hat | openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:20277c93f1c079f400935a95fda93e4dd0098792a1648ab9bdaaf214ec683571_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-aws-ebs-csi-driver-rhel8@sha256:20277c93f1c079f400935a95fda93e4dd0098792a1648ab9bdaaf214ec683571_amd64 |
| Red Hat | openshift4/ose-kube-storage-version-migrator-rhel8@sha256:501d244015bfdb0a2829eb8ccb8cb5da16dd1f2997c71b0f030a2afdaa1bef73_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-kube-storage-version-migrator-rhel8@sha256:501d244015bfdb0a2829eb8ccb8cb5da16dd1f2997c71b0f030a2afdaa1bef73_arm64 |
| Red Hat | openshift4/ose-tools-rhel8@sha256:562da8d1d9b093e32fd60132b4e82d3011f602e277d6354324f354515c14863e_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-tools-rhel8@sha256:562da8d1d9b093e32fd60132b4e82d3011f602e277d6354324f354515c14863e_arm64 |
| Red Hat | openshift4/ose-openshift-apiserver-rhel8@sha256:f35c4a2d4a908eee8ad0945d431e8d6ae37352f1332c6827be9f541ffee6f668_ppc64le as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | openshift4/ose-machine-api-operator@sha256:9bfd4b83a4584aeae419dcdb63951882016377d8ec5924c3af63583a0ee78a80_ppc64le as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | openshift4/ose-prometheus-operator-admission-webhook-rhel8@sha256:752d4dfbc39490ccf4ae97f1fd22aac0eece0cddd6034ec2bf492132f468a770_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-prometheus-operator-admission-webhook-rhel8@sha256:752d4dfbc39490ccf4ae97f1fd22aac0eece0cddd6034ec2bf492132f468a770_amd64 |
| Red Hat | openshift4/ose-machine-api-provider-aws-rhel8@sha256:cd0c0474ae4d5048370737bed8c5d85281a64002526fc52f70aa119c127b804a_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-machine-api-provider-aws-rhel8@sha256:cd0c0474ae4d5048370737bed8c5d85281a64002526fc52f70aa119c127b804a_amd64 |
| Red Hat | openshift4/ose-cluster-openshift-apiserver-operator@sha256:783d250b2315105323ae16f636cdbd40275b943d31672e531ae29e73f00f78d5_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-cluster-openshift-apiserver-operator@sha256:783d250b2315105323ae16f636cdbd40275b943d31672e531ae29e73f00f78d5_arm64 |
| Red Hat | openshift4/ose-multus-whereabouts-ipam-cni-rhel8@sha256:561b700fbfac5165ea38f490689852bb425ced72090532d8ee7e8ead4e725831_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-multus-whereabouts-ipam-cni-rhel8@sha256:561b700fbfac5165ea38f490689852bb425ced72090532d8ee7e8ead4e725831_arm64 |
| Red Hat | openshift4/ose-ovn-kubernetes@sha256:20bd5d8adb6e97d2e4b2fe4d61e11cec0b4452bf353977ecda24cc492ca867c1_s390x as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-ovn-kubernetes@sha256:20bd5d8adb6e97d2e4b2fe4d61e11cec0b4452bf353977ecda24cc492ca867c1_s390x |
| Red Hat | openshift4/ose-hypershift-rhel8@sha256:6735269a4cd19715136ca1ba8e1b6dfe9e30e6d51e761111c791646f78bda6e4_ppc64le as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-hypershift-rhel8@sha256:6735269a4cd19715136ca1ba8e1b6dfe9e30e6d51e761111c791646f78bda6e4_ppc64le |
| Red Hat | openshift4/ose-csi-external-attacher@sha256:47693a0588f327fc04fc7fb7d2c3b6e3d38c9bbfbb359423bc78dec1f720e122_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | openshift4/ose-operator-marketplace@sha256:846592a9c0d06a6d00b727f5f2235066abb3761af425f83129f770e40d5e72e6_ppc64le as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-operator-marketplace@sha256:846592a9c0d06a6d00b727f5f2235066abb3761af425f83129f770e40d5e72e6_ppc64le |
| Red Hat | openshift4/ose-kube-proxy@sha256:43c5ba4907c97ce60620ec61f722184e6caf7b69ccb9b74f658b6da9f20aca0f_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-kube-proxy@sha256:43c5ba4907c97ce60620ec61f722184e6caf7b69ccb9b74f658b6da9f20aca0f_arm64 |
| Red Hat | openshift4/ose-openstack-machine-controllers@sha256:d98b56bb0d596978428be8eb0e303a3e851f25d5bb4830d1e191bf162309b08c_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | openshift4/ose-csi-snapshot-controller@sha256:f3409cceb70fea02db009fe53bf459a41079c04a01013c2a5a7bc64e9bbcbf1e_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | * |
| Red Hat | openshift4/ose-cluster-machine-approver@sha256:4b563090fb31dd2dfce6284ee81d64096a82af064dd7152789f66ad605796717_arm64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-cluster-machine-approver@sha256:4b563090fb31dd2dfce6284ee81d64096a82af064dd7152789f66ad605796717_arm64 |
| Red Hat | openshift4/ose-kube-proxy@sha256:14d027d2f6747b0b5081e1d2d1a6d661930bd0fef6874c3ecb1a24a7cf0646f6_s390x as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-kube-proxy@sha256:14d027d2f6747b0b5081e1d2d1a6d661930bd0fef6874c3ecb1a24a7cf0646f6_s390x |
| Red Hat | openshift4/ose-kube-proxy@sha256:ebb5358fa3da387416b7b2037b6f56df58bea889d80c1d5b423247db9d86ec0b_amd64 as a component of Red Hat OpenShift Container Platform 4.12 | openshift4/ose-kube-proxy@sha256:ebb5358fa3da387416b7b2037b6f56df58bea889d80c1d5b423247db9d86ec0b_amd64 |
…and 614 more
Timeline
- May 10, 2023 CVE Published
- Apr 30, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2023:2110 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://docs.openshift.com/container-platform/4.12/release_notes/ocp-4-12-release-notes.html advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2149436 issue
- https://issues.redhat.com/browse/OCPBUGS-11559 advisory
- https://issues.redhat.com/browse/OCPBUGS-11844 advisory
- https://issues.redhat.com/browse/OCPBUGS-11972 advisory
- https://issues.redhat.com/browse/OCPBUGS-11993 advisory
- https://issues.redhat.com/browse/OCPBUGS-12199 advisory
- https://issues.redhat.com/browse/OCPBUGS-12265 advisory
- https://issues.redhat.com/browse/OCPBUGS-12361 advisory
- https://issues.redhat.com/browse/OCPBUGS-12440 advisory
- https://issues.redhat.com/browse/OCPBUGS-12473 advisory
- https://issues.redhat.com/browse/OCPBUGS-12476 advisory
- https://issues.redhat.com/browse/OCPBUGS-12477 advisory
- https://issues.redhat.com/browse/OCPBUGS-12688 advisory
- https://issues.redhat.com/browse/OCPBUGS-1753 advisory
- https://issues.redhat.com/browse/OCPBUGS-6888 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_2110.json advisory
- https://access.redhat.com/security/cve/CVE-2022-46146 advisory
…and 6 more