Summary: MITM in foreman_kubevirt due to insecure defaults Requirements to exploit: Being able to MITM traffic between Satellite and OpenShift Component affected: https://github.com/theforeman/foreman_kubevirt Version affected: <= 0.4.0 Patch available: no Version fixed (if any already): N/A CVSS (optional): N/A Impact (optional): Important Embargo: No Reason: The amount of affected systems should be low Suggested public date: dd-MMM-yyyy Acknowledgement: Evgeni Golov Steps to reproduce if available: Configure OpenShift Virtualization / KubeVirt in Satellite and don't enter anything in the CA field Mitigation if available: Explicitly set a CA Original report: this email When foreman_kubevirt configures the connection to OpenShift, it only enables `kubevirt_verify_ssl` when a CA certificate was explicitly set in the settings [1]. Normally, users would expect that the system trust store is used when no explicit CA was set. But in this case the whole verification is disabled instead.
This issue has been addressed in the following products: Red Hat Satellite 6.17 for RHEL 9 Via RHSA-2026:5970 https://access.redhat.com/errata/RHSA-2026:5970
This issue has been addressed in the following products: Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9 Via RHSA-2026:5971 https://access.redhat.com/errata/RHSA-2026:5971