VDB
RHSA-2023%3A5001
RHSA-2023%3A5001
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in exporter-toolkit. A request can be forged by an attacker to poison the internal cache used to cache hashes and make subsequent successful requests. This cache is used to limit side channel attacks that could tell an attacker if a user is present in the file or not. Prometheus and its exporters can be secured by a web.yml file that specifies usernames and hashed passwords for basic authentication. Passwords are hashed with bcrypt, which means that even if you have access to the hash, it is very hard to find the original password. However, due to the way this mechanism was implemented in the exporter toolkit, if the hashed password is known, it is possible to authenticate against Prometheus.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/ose-operator-marketplace@sha256:2a9188c309234567df385e63da65635f0809f2694efd55b4edb33dc8a23b6b85_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-operator-marketplace@sha256:2a9188c309234567df385e63da65635f0809f2694efd55b4edb33dc8a23b6b85_ppc64le |
| Red Hat | openshift4/ose-multus-route-override-cni-rhel8@sha256:f3b4f2d3693222fb7b823442d3cd05d7ac1e4a074f37fc21e3241de18807c5cf_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | * |
| Red Hat | openshift4/ose-gcp-pd-csi-driver-rhel8@sha256:4dea285a6df821086361887d404d751ac1b20e3d1d5812d8f03edf17e2604dda_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-gcp-pd-csi-driver-rhel8@sha256:4dea285a6df821086361887d404d751ac1b20e3d1d5812d8f03edf17e2604dda_amd64 |
| Red Hat | openshift4/ose-installer@sha256:bd6bbf520453435423ac80ca960a1711dd7d7d939f502c1b8165d24ed01fae41_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-installer@sha256:bd6bbf520453435423ac80ca960a1711dd7d7d939f502c1b8165d24ed01fae41_amd64 |
| Red Hat | openshift4/ose-cluster-samples-operator@sha256:60e4f535498fbaf861bfe807b88e9e11fa1b845a27fad6940c60141506b416c2_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cluster-samples-operator@sha256:60e4f535498fbaf861bfe807b88e9e11fa1b845a27fad6940c60141506b416c2_amd64 |
| Red Hat | openshift4/ose-cluster-openshift-apiserver-operator@sha256:8cc970f1ee9415dfc14ee62f302373cf87cce6caa84467a99f911e2be57d3260_s390x as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cluster-openshift-apiserver-operator@sha256:8cc970f1ee9415dfc14ee62f302373cf87cce6caa84467a99f911e2be57d3260_s390x |
| Red Hat | openshift4/ose-multus-networkpolicy-rhel8@sha256:f512134bfe7b057b1b52ab0e860c9c58a69574bbbcd9b69d32784a10c97c9da9_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-multus-networkpolicy-rhel8@sha256:f512134bfe7b057b1b52ab0e860c9c58a69574bbbcd9b69d32784a10c97c9da9_amd64 |
| Red Hat | openshift4/ose-openstack-cinder-csi-driver-rhel8@sha256:1232dffdbd65b881d209ab37d8d9879f3c4badd30ad68b6fed7a48dd70c9470b_s390x as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-openstack-cinder-csi-driver-rhel8@sha256:1232dffdbd65b881d209ab37d8d9879f3c4badd30ad68b6fed7a48dd70c9470b_s390x |
| Red Hat | openshift4/ose-cluster-image-registry-operator@sha256:39a8825febb6653ee716252f7c00922c30d50af4db8c79a2eb87c24eb785439a_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cluster-image-registry-operator@sha256:39a8825febb6653ee716252f7c00922c30d50af4db8c79a2eb87c24eb785439a_amd64 |
| Red Hat | openshift4/ose-csi-driver-manila-rhel8@sha256:d42f4d93bac853665d4190e3325a13705807b73c2646c6ad902a4755fff905b0_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-csi-driver-manila-rhel8@sha256:d42f4d93bac853665d4190e3325a13705807b73c2646c6ad902a4755fff905b0_ppc64le |
| Red Hat | openshift4/ose-tests@sha256:7e206d75523f6eeb184c0f251384f2e694ca848555a41fc26cf5ba48ced6ddc7_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-tests@sha256:7e206d75523f6eeb184c0f251384f2e694ca848555a41fc26cf5ba48ced6ddc7_amd64 |
| Red Hat | openshift4/ose-ovn-kubernetes@sha256:2fda5ce1ceefeff00615804f7ddb5bd6b0b5f2dc8e16be3730db5d6906a536c3_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-ovn-kubernetes@sha256:2fda5ce1ceefeff00615804f7ddb5bd6b0b5f2dc8e16be3730db5d6906a536c3_arm64 |
| Red Hat | openshift4/ose-cluster-ingress-operator@sha256:43dcc41ad0c19c757aacc0ad74ffd7274e188f93dc7073743640b792ffb54612_ppc64le as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cluster-ingress-operator@sha256:43dcc41ad0c19c757aacc0ad74ffd7274e188f93dc7073743640b792ffb54612_ppc64le |
| Red Hat | openshift4/network-tools-rhel8@sha256:39a7dff7fbde248bb760235ccbc240927d76ab0177f5146579061bb345d8acb6_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/network-tools-rhel8@sha256:39a7dff7fbde248bb760235ccbc240927d76ab0177f5146579061bb345d8acb6_amd64 |
| Red Hat | openshift4/ose-insights-rhel8-operator@sha256:40e741b761f3f55a34004cc45066d0f6b504c34ce0ff63486537920945ddb18a_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | * |
| Red Hat | openshift4/ose-machine-api-provider-gcp-rhel8@sha256:96dd09033ef8c258f58f983624b0312273e48ef26d3c8c5c41f8eb3478c07b34_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-machine-api-provider-gcp-rhel8@sha256:96dd09033ef8c258f58f983624b0312273e48ef26d3c8c5c41f8eb3478c07b34_amd64 |
| Red Hat | openshift4/ose-cluster-capi-operator-container-rhel8@sha256:ab12078bb9b892760e2d35b27c4b4139a199d0de1285448b115068d01d255f04_arm64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-cluster-capi-operator-container-rhel8@sha256:ab12078bb9b892760e2d35b27c4b4139a199d0de1285448b115068d01d255f04_arm64 |
| Red Hat | openshift4/ose-powervs-cloud-controller-manager-rhel8@sha256:8baee4a771783ed1dc821458eedb17c0c673cbb038f8eef1ecda856cc1cc6ca8_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | openshift4/ose-powervs-cloud-controller-manager-rhel8@sha256:8baee4a771783ed1dc821458eedb17c0c673cbb038f8eef1ecda856cc1cc6ca8_amd64 |
| Red Hat | openshift4/ose-machine-config-operator@sha256:bc5008f5c836a456e3d0346fa1b3c895185f45f91bd7f0cd218ad9e3ed05e704_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | * |
| Red Hat | openshift4/ose-image-customization-controller-rhel8@sha256:a0b413262b59cde1f9f502b35093cf2d7dfe1907605e1d203a1fa03425ff821e_amd64 as a component of Red Hat OpenShift Container Platform 4.11 | * |
…and 588 more
Timeline
- Sep 13, 2023 CVE Published
- Apr 30, 2026 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2023:5001 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://docs.openshift.com/container-platform/4.11/release_notes/ocp-4-11-release-notes.html advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2149436 issue
- https://issues.redhat.com/browse/OCPBUGS-12819 advisory
- https://issues.redhat.com/browse/OCPBUGS-14012 advisory
- https://issues.redhat.com/browse/OCPBUGS-14387 advisory
- https://issues.redhat.com/browse/OCPBUGS-16791 advisory
- https://issues.redhat.com/browse/OCPBUGS-17189 advisory
- https://issues.redhat.com/browse/OCPBUGS-17955 advisory
- https://issues.redhat.com/browse/OCPBUGS-18075 advisory
- https://issues.redhat.com/browse/OCPBUGS-18283 advisory
- https://issues.redhat.com/browse/OCPBUGS-18509 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_5001.json advisory
- https://access.redhat.com/security/cve/CVE-2022-46146 advisory
- https://www.cve.org/CVERecord?id=CVE-2022-46146 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-46146 advisory
- http://www.openwall.com/lists/oss-security/2022/11/29/1 advisory
- http://www.openwall.com/lists/oss-security/2022/11/29/2 advisory
- https://github.com/prometheus/exporter-toolkit/commit/5b1eab34484ddd353986bce736cd119d863e4ff5 advisory
…and 1 more