Cryostat: authentication bypass if network policies are disabled
A vulnerability was found in the Cryostat HTTP API. Cryostat's HTTP API binds to all network interfaces, allowing possible external visibility and access to the API port if Network Policies are disabled, allowing an unauthenticated, malicious attacker to jeopardize the environment.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Cryostat
Vendor
Cryostat
Product
Cryostat
Platforms
Unknown
Default status
unaffected
Package
cryostat
Package collection
https://github.com/cryostatio/cryostat
Cryostat · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0
affected
semver
4.0.2
Unavailable
None listed
Cryostat 4 on RHEL 9
Vendor
Red Hat
Product
Cryostat 4 on RHEL 9
Platforms
Unknown
Default status
affected
Package
cryostat/cryostat-agent-init-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Cryostat 4 on RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
0.5.2-3
unaffected
rpm
*
Unavailable
None listed
Cryostat 4 on RHEL 9
Vendor
Red Hat
Product
Cryostat 4 on RHEL 9
Platforms
Unknown
Default status
affected
Package
cryostat/cryostat-db-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Cryostat 4 on RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.0.2-3
unaffected
rpm
*
Unavailable
None listed
Cryostat 4 on RHEL 9
Vendor
Red Hat
Product
Cryostat 4 on RHEL 9
Platforms
Unknown
Default status
affected
Package
cryostat/cryostat-grafana-dashboard-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Cryostat 4 on RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.0.2-3
unaffected
rpm
*
Unavailable
None listed
Cryostat 4 on RHEL 9
Vendor
Red Hat
Product
Cryostat 4 on RHEL 9
Platforms
Unknown
Default status
affected
Package
cryostat/cryostat-openshift-console-plugin-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Cryostat 4 on RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.0.2-3
unaffected
rpm
*
Unavailable
None listed
Cryostat 4 on RHEL 9
Vendor
Red Hat
Product
Cryostat 4 on RHEL 9
Platforms
Unknown
Default status
affected
Package
cryostat/cryostat-operator-bundle
Package collection
https://catalog.redhat.com/software/containers/
Cryostat 4 on RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.0.2-3
unaffected
rpm
*
Unavailable
None listed
Cryostat 4 on RHEL 9
Vendor
Red Hat
Product
Cryostat 4 on RHEL 9
Platforms
Unknown
Default status
affected
Package
cryostat/cryostat-ose-oauth-proxy-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Cryostat 4 on RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.0.2-3
unaffected
rpm
*
Unavailable
None listed
Cryostat 4 on RHEL 9
Vendor
Red Hat
Product
Cryostat 4 on RHEL 9
Platforms
Unknown
Default status
affected
Package
cryostat/cryostat-reports-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Cryostat 4 on RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.0.2-3
unaffected
rpm
*
Unavailable
None listed
Cryostat 4 on RHEL 9
Vendor
Red Hat
Product
Cryostat 4 on RHEL 9
Platforms
Unknown
Default status
affected
Package
cryostat/cryostat-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Cryostat 4 on RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.0.2-3
unaffected
rpm
*
Unavailable
None listed
Cryostat 4 on RHEL 9
Vendor
Red Hat
Product
Cryostat 4 on RHEL 9
Platforms
Unknown
Default status
affected
Package
cryostat/cryostat-rhel9-operator
Package collection
https://catalog.redhat.com/software/containers/
Cryostat 4 on RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.0.2-3
unaffected
rpm
*
Unavailable
None listed
Cryostat 4 on RHEL 9
Vendor
Red Hat
Product
Cryostat 4 on RHEL 9
Platforms
Unknown
Default status
affected
Package
cryostat/cryostat-storage-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Cryostat 4 on RHEL 9 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
4.0.2-3
unaffected
rpm
*
Unavailable
None listed
Cryostat 4 on RHEL 9
Vendor
Red Hat
Product
Cryostat 4 on RHEL 9
Platforms
Unknown
Default status
affected
Package
cryostat/jfr-datasource-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Cryostat 4 on RHEL 9 · Scoped product and version facts