Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch
A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Red Hat OpenShift Container Platform 4.14
Vendor
Red Hat
Product
Red Hat OpenShift Container Platform 4.14
Platforms
Unknown
Default status
affected
Package
openshift4/ose-console
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.14 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1791842061
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift Container Platform 4.15
Vendor
Red Hat
Product
Red Hat OpenShift Container Platform 4.15
Platforms
Unknown
Default status
affected
Package
openshift4/ose-console
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.15 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1791836468
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift Container Platform 4.19
Vendor
Red Hat
Product
Red Hat OpenShift Container Platform 4.19
Platforms
Unknown
Default status
affected
Package
openshift4/ose-console-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.19 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1791626503
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift Container Platform 4.20
Vendor
Red Hat
Product
Red Hat OpenShift Container Platform 4.20
Platforms
Unknown
Default status
affected
Package
openshift4/ose-console-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.20 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1791962432
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift Container Platform 4.21
Vendor
Red Hat
Product
Red Hat OpenShift Container Platform 4.21
Platforms
Unknown
Default status
affected
Package
openshift4/ose-console-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.21 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1792057253
unaffected
rpm
*
Unavailable
None listed
Red Hat OpenShift Container Platform 4.22
Vendor
Red Hat
Product
Red Hat OpenShift Container Platform 4.22
Platforms
Unknown
Default status
affected
Package
openshift4/ose-console-rhel9
Package collection
https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.22 · Scoped product and version facts