Openshift
15 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2024-45497 | 4.16 | Openshift-api: openshift-controller-manager/build: build process in openshift allows overwriting of node pull credentials | HIGH 7.6 | 0.6 % | ||
| CVE-2023-6596 | < 4.11.58 ; 4.12.0 – < 4.12.48 | Openshift: incomplete fix for rapid reset (cve-2023-44487/cve-2023-39325) | HIGH 7.5 | 0.8 % | ||
| CVE-2022-4145 | | Content spoofing | MEDIUM 5.3 | 0.6 % | ||
| CVE-2023-3089 | fixed in 4.12.0 | Ocp & fips mode | HIGH 7.5 | 0.5 % | ||
| CVE-2022-3259 | 4.9.0 | Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks. | HIGH 7.4 | 0.6 % | ||
| CVE-2022-3262 | 4.9 | A flaw was found in Openshift. A pod with a DNSPolicy of "ClusterFirst" may incorrectly resolve the hostname based on a service provided. Th | HIGH 8.1 | 0.8 % | ||
| CVE-2022-3260 | 4.9 | The response header has not enabled X-FRAME-OPTIONS, Which helps prevents against Clickjacking attack.. Some browsers would interpret these | MEDIUM 4.8 | 0.5 % | ||
| CVE-2022-2403 | Openshift 4.9 onwards | A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectl | MEDIUM 6.5 | 0.6 % | ||
| CVE-2022-1677 | Openshift 3.11 and 4.6 onwards | In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into | MEDIUM 6.3 | 0.6 % | ||
| CVE-2022-1632 | 4.8.17 | An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the def | MEDIUM 6.5 | 0.4 % | ||
| CVE-2021-4047 | OpenShift 4.9 | The release of OpenShift 4.9.6 included four CVE fixes for the haproxy package, however the patch for CVE-2021-39242 was missing. This issue | HIGH 7.5 | 0.9 % | ||
| CVE-2021-3636 | openshift 4.8 | It was found in OpenShift, before version 4.8, that the generated certificate for the in-cluster Service CA, incorrectly included additional | MEDIUM 4.6 | 0.3 % | ||
| CVE-2020-14336 | Red Hat OpenShift Container Platform 4.6 and Red Hat OpenShift Container Platform 4.5.16 | A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allow | MEDIUM 6.5 | 0.9 % | ||
| CVE-2021-20182 | github.com/openshift/builder v0.0.0-20210118193943-6d10f5202a76 | A privilege escalation flaw was found in openshift4/ose-docker-builder. The build container runs with high privileges using a chrooted envir | HIGH 8.8 | 1.1 % | ||
| CVE-2016-9592 | openshift 3.3.1.11 ; openshift 3.2.1.23 ; openshift 3.4 | openshift before versions 3.3.1.11, 3.2.1.23, 3.4 is vulnerable to a flaw when a volume fails to detach, which causes the delete operation t | MEDIUM 4.3 | 1.2 % |