A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1655 advisory.

  - kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) (CVE-2022-3172)

  - spring-security-oauth2-client: Privilege Escalation in spring-security-oauth2-client (CVE-2022-31690)

  - spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring     Security (CVE-2022-31692)

  - apache-commons-text: variable interpolation RCE (CVE-2022-42889)

  - jenkins-2-plugins/script-security: Sandbox bypass vulnerability in Script Security Plugin (CVE-2023-24422)

  - haproxy: request smuggling attack in HTTP/1 header parsing (CVE-2023-25725)

  - Jenkins: XSS vulnerability in plugin manager (CVE-2023-27898)

  - Jenkins: Temporary plugin file created with insecure permissions (CVE-2023-27899)

  - Jenkins: Temporary file parameter created with insecure permissions (CVE-2023-27903)

  - Jenkins: Information disclosure through error stack traces related to agents (CVE-2023-27904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7398 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing     Kubernetes application platform solution designed for on-premise or private     cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.12.0. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2022:7399

    Security Fix(es):

    * go-yaml: Denial of Service in go-yaml (CVE-2021-4235)
    * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
    * kubernetes: Unauthorized read of Custom Resources (CVE-2022-3162)
    * kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF) (CVE-2022-3172)
    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
    * golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
    * golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
    * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
    * cri-o: incorrect handling of the supplementary groups (CVE-2022-2995)
    * OpenShift: Missing HTTP Strict Transport Security (CVE-2022-3259)
    * cri-o: Security regression of CVE-2022-27652 (CVE-2022-3466)
    * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short,     potentially allowing a denial of service (CVE-2022-32189)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift Console or the CLI oc command. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:7398 advisory.

  - Due to unbounded alias chasing, a maliciously crafted YAML file can cause the system to consume     significant system resources. If parsing user input, this may be used as a denial of service vector.
    (CVE-2021-4235)

  - Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12     and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly     fails to reject the header as invalid. (CVE-2022-1705)

  - In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because     an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error. (CVE-2022-27664)

  - Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could     cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics.
    After fix, Reader.Read limits the maximum size of header blocks to 1 MiB. (CVE-2022-2879)

  - Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including     unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy     forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in     the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director     function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse     query parameters continue to forward the original query parameters unchanged. (CVE-2022-2880)

  - Incorrect handling of the supplementary groups in the CRI-O container engine might lead to sensitive     information disclosure or possible data modification if an attacker has direct access to the affected     container where supplementary groups are used to set access permissions and is able to execute a binary     code in that container. (CVE-2022-2995)

  - python-scciclient: missing server certificate verification (CVE-2022-2996)

  - Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker     to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length     compressed files. (CVE-2022-30631)

  - Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom     resources of a different type in the same API group without authorization. Clusters are impacted by this     vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same     API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The     same users are not authorized to read another custom resource in the same API group. (CVE-2022-3162)

  - A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client     traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the     client's API server credentials to third parties. (CVE-2022-3172)

  - Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by     calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the     X-Forwarded-For header, which causes ReverseProxy to set the client IP as the value of the X-Forwarded-For     header. (CVE-2022-32148)

  - A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go     before 1.17.13 and 1.18.5, potentially allowing a denial of service. (CVE-2022-32189)

  - JoinPath and URL.JoinPath do not remove ../ path elements appended to a relative path. For example,     JoinPath(https://go.dev, ../go) returns the URL https://go.dev/../go, despite the JoinPath     documentation stating that ../ path elements are removed from the result. (CVE-2022-32190)

  - Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM)     attacks. (CVE-2022-3259)

  - The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via     RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o     missing the fix for CVE-2022-27652, which was previously fixed in OCP 4.9.41 and 4.10.12 via     RHBA-2022:5433 and RHSA-2022:1600. This issue could allow an attacker with access to programs with     inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For     more details, see https://access.redhat.com/security/cve/CVE-2022-27652. (CVE-2022-3466)

  - Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion     or denial of service. The parsed regexp representation is linear in the size of the input, but in some     cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger     amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular     expressions whose representation would use more space than that are rejected. Normal use of regular     expressions is unaffected. (CVE-2022-41715)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Red Hat Enterprise Linux CoreOS 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:1655 advisory.

  - Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could     be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify     a request initiated by the Client (via the browser) to the Authorization Server which can lead to a     privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server     responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1)     on the subsequent request to the token endpoint to obtain the access token. (CVE-2022-31690)

  - Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization     rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all     of the following are true: The application expects that Spring Security applies security to forward and     include dispatcher types. The application uses the AuthorizationFilter either manually or via the     authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or     include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include).
    The application may forward or include the request to a higher privilege-secured endpoint.The application     configures Spring Security to apply to every dispatcher type via     authorizeHttpRequests().shouldFilterAllDispatcherTypes(true) (CVE-2022-31692)

  - A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client     traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the     client's API server credentials to third parties. (CVE-2022-3172)

  - Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and     expanded. The standard format for interpolation is ${prefix:name}, where prefix is used to locate an     instance of org.apache.commons.text.lookup.StringLookup that performs the interpolation. Starting with     version 1.5 and continuing through 1.9, the set of default Lookup instances included interpolators that     could result in arbitrary code execution or contact with remote servers. These lookups are: - script -     execute expressions using the JVM script execution engine (javax.script) - dns - resolve dns records -     url - load values from urls, including from remote servers Applications using the interpolation defaults     in the affected versions may be vulnerable to remote code execution or unintentional contact with remote     servers if untrusted configuration values are used. Users are recommended to upgrade to Apache Commons     Text 1.10.0, which disables the problematic interpolators by default. (CVE-2022-42889)

  - A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin     1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts,     including Pipelines, to bypass the sandbox protection and execute arbitrary code in the context of the     Jenkins controller JVM. (CVE-2023-24422)

  - HAProxy before 2.7.3 may allow a bypass of access control because HTTP/1 headers are inadvertently lost in     some situations, aka request smuggling. The HTTP header parsers in HAProxy may accept empty header field     names, which could be used to truncate the list of HTTP headers and thus make some headers disappear after     being parsed and processed for HTTP/1.0 and HTTP/1.1. For HTTP/2 and HTTP/3, the impact is limited because     the headers disappear before being parsed and processed, as if they had not been sent by the client. The     fixed versions are 2.7.3, 2.6.9, 2.5.12, 2.4.22, 2.2.29, and 2.0.31. (CVE-2023-25725)

  - Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape     the Jenkins version a plugin depends on when rendering the error message stating its incompatibility with     the current version of Jenkins, resulting in a stored cross-site scripting (XSS) vulnerability exploitable     by attackers able to provide plugins to the configured update sites and have this message shown by Jenkins     instances. (CVE-2023-27898)

  - Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary     directory with the default permissions for newly created files when uploading a plugin for installation,     potentially allowing attackers with access to the Jenkins controller file system to read and write the     file before it is used, potentially resulting in arbitrary code execution. (CVE-2023-27899)

  - Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary     directory with the default permissions for newly created files when uploading a file parameter through the     CLI, potentially allowing attackers with access to the Jenkins controller file system to read and write     the file before it is used. (CVE-2023-27903)

  - Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when     agent connections are broken, potentially revealing information about Jenkins configuration that is     otherwise inaccessible to attackers. (CVE-2023-27904)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9854 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9853 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9855 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-9856 advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194304	RHEL 7 / 8 : OpenShift Container Platform 4.10.56 (RHSA-2023:1655)	Nessus	Red Hat Local Security Checks	critical
194196	RHEL 8 / 9 : OpenShift Container Platform 4.12.0 (RHSA-2022:7398)	Nessus	Red Hat Local Security Checks	high
189448	RHCOS 4 : OpenShift Container Platform 4.12.0 (RHSA-2022:7398)	Nessus	Red Hat Local Security Checks	high
189435	RHCOS 4 : OpenShift Container Platform 4.10.56 (RHSA-2023:1655)	Nessus	Red Hat Local Security Checks	critical
165712	Oracle Linux 8 : kubernetes (ELSA-2022-9854)	Nessus	Oracle Linux Local Security Checks	high
165711	Oracle Linux 7 : kubernetes (ELSA-2022-9853)	Nessus	Oracle Linux Local Security Checks	high
165639	Oracle Linux 7 : kubernetes (ELSA-2022-9855)	Nessus	Oracle Linux Local Security Checks	high
165638	Oracle Linux 8 : kubernetes (ELSA-2022-9856)	Nessus	Oracle Linux Local Security Checks	high

Detections

Analytics

CVE-2022-3172

high

Tenable Plugins

critical

high

high

critical

high

high

high

high