Bug 2233087 (CVE-2023-4456)

Summary:	CVE-2023-4456 openshift-logging: LokiStack authorisation is cached too broadly
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jcantril
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in openshift-logging LokiStack. The key used for caching is just the token, which is too broad. This issue allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2233088

Description Avinash Hanwate 2023-08-21 11:43:36 UTC

The opa-openshift component is responsible for authorizing the requests going to the LokiStack through the gateway. Requests are authenticated using a token and authorization happens by, among other things, checking for an RBAC privilege. To reduce the number of SubjectAccessReviews the result of the authorization is cached in opa-openshift for a while. Currently, the key used for this caching is just the token, which is too broad and allows a user with a token valid for one action to execute other actions as long as the authorization allowing the original action is still cached.

Comment 2 errata-xmlrpc 2023-09-13 14:01:29 UTC

This issue has been addressed in the following products:

  RHOL-5.7-RHEL-8

Via RHSA-2023:4933 https://access.redhat.com/errata/RHSA-2023:4933

Comment 5 errata-xmlrpc 2023-09-20 15:02:49 UTC

This issue has been addressed in the following products:

  RHOL-5.5-RHEL-8

Via RHSA-2023:5096 https://access.redhat.com/errata/RHSA-2023:5096

Comment 6 errata-xmlrpc 2023-09-20 15:22:54 UTC

This issue has been addressed in the following products:

  RHOL-5.6-RHEL-8

Via RHSA-2023:5095 https://access.redhat.com/errata/RHSA-2023:5095