Bug 1888475 (CVE-2020-25655) - CVE-2020-25655 open-cluster-management: RBAC bypass may disclose cluster secrets to other users
Summary: CVE-2020-25655 open-cluster-management: RBAC bypass may disclose cluster secr...
Keywords:
Status: NEW
Alias: CVE-2020-25655
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 1882496 1888476
Blocks: 1888225
TreeView+ depends on / blocked
 
Reported: 2020-10-14 23:57 UTC by Doran Moppert
Modified: 2023-10-25 17:21 UTC (History)
4 users (show)

Fixed In Version: open-cluster-management 2.0.4, open-cluster-management 2.1.0
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4304 0 None None None 2020-10-22 11:23:45 UTC

Description Doran Moppert 2020-10-14 23:57:46 UTC 
An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions.  Views created for an admin user would be made available for a short time to users with only view permission.  In this short time window the user with view permission could read cluster secrets that should only be disclosed to admin users.
Comment 6 errata-xmlrpc 2020-10-22 11:23:55 UTC 
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.0 for RHEL 8
  Red Hat Advanced Cluster Management for Kubernetes 2.0 for RHEL 7

Via RHSA-2020:4304 https://access.redhat.com/errata/RHSA-2020:4304
Note You need to log in before you can comment on or make changes to this bug.