2 lines
7.5 KiB
JSON
2 lines
7.5 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://github.com/openshift/telemeter","defaultStatus":"unaffected","packageName":"telemeter","versions":[{"lessThan":"4.17","status":"affected","version":"4.16","versionType":"semver"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.12::el8","cpe:/a:redhat:openshift:4.12::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-telemeter","product":"Red Hat OpenShift Container Platform 4.12","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"v4.12.0-202408071159.p0.gc9592de.assembly.stream.el8","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.13::el8","cpe:/a:redhat:openshift:4.13::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-telemeter","product":"Red Hat OpenShift Container Platform 4.13","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"v4.13.0-202407081338.p0.g0634a6d.assembly.stream.el8","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.14::el8","cpe:/a:redhat:openshift:4.14::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-telemeter","product":"Red Hat OpenShift Container Platform 4.14","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"v4.14.0-202407021509.p0.g1f72681.assembly.stream.el8","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.15::el8","cpe:/a:redhat:openshift:4.15::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-telemeter-rhel9","product":"Red Hat OpenShift Container Platform 4.15","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"v4.15.0-202406200537.p0.g14489f7.assembly.stream.el9","versionType":"rpm"}]},{"collectionURL":"https://catalog.redhat.com/software/containers/","cpes":["cpe:/a:redhat:openshift:4.16::el9"],"defaultStatus":"affected","packageName":"openshift4/ose-telemeter-rhel9","product":"Red Hat OpenShift Container Platform 4.16","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"v4.16.0-202406200537.p0.gc1ecd10.assembly.stream.el9","versionType":"rpm"}]},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:logging:5"],"defaultStatus":"unaffected","packageName":"openshift-logging/opa-openshift-rhel8","product":"Logging Subsystem for Red Hat OpenShift","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_distributed_tracing:2"],"defaultStatus":"affected","packageName":"rhosdt/tempo-gateway-opa-rhel8","product":"Red Hat OpenShift distributed tracing 2","vendor":"Red Hat"},{"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift_distributed_tracing:3"],"defaultStatus":"affected","packageName":"rhosdt/tempo-gateway-opa-rhel8","product":"Red Hat OpenShift distributed tracing 3","vendor":"Red Hat"}],"source":"secalert@redhat.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*","matchCriteriaId":"932D137F-528B-4526-9A89-CD59FA1AB0FE","vulnerable":true},{"criteria":"cpe:2.3:a:redhat:openshift_distributed_tracing:2.0:*:*:*:*:*:*:*","matchCriteriaId":"BC859D38-CE10-4898-96CF-681BC3714AF7","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue (\"iss\") check during JSON web token (JWT) authentication."},{"lang":"es","value":"Se encontró una falla en Telemeter de OpenShift. Si se cumplen ciertas condiciones, un atacante puede usar un token falsificado para evitar la verificación del problema (\"iss\") durante la autenticación del token web JSON (JWT)."}],"id":"CVE-2024-5037","lastModified":"2026-06-17T08:14:57.353","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"secalert@redhat.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2024-5037","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2024-07-13T20:15:59.404791Z","version":"2.0.3"}}]},"published":"2024-06-05T18:15:11.747","references":[{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2024:4151"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2024:4156"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2024:4329"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2024:4484"},{"source":"secalert@redhat.com","url":"https://access.redhat.com/errata/RHSA-2024:5200"},{"source":"secalert@redhat.com","tags":["Vendor Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2024-5037"},{"source":"secalert@redhat.com","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2272339"},{"source":"secalert@redhat.com","tags":["Patch","Third Party Advisory"],"url":"https://github.com/kubernetes/kubernetes/pull/123540"},{"source":"secalert@redhat.com","tags":["Product"],"url":"https://github.com/openshift/telemeter/blob/a9417a6062c3a31ed78c06ea3a0613a52f2029b2/pkg/authorize/jwt/client_authorizer.go#L78"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/errata/RHSA-2024:4151"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/errata/RHSA-2024:4156"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/errata/RHSA-2024:4329"},{"source":"af854a3a-2127-422b-91ae-364da2661108","url":"https://access.redhat.com/errata/RHSA-2024:4484"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://access.redhat.com/security/cve/CVE-2024-5037"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Vendor Advisory"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2272339"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Third Party Advisory"],"url":"https://github.com/kubernetes/kubernetes/pull/123540"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Product"],"url":"https://github.com/openshift/telemeter/blob/a9417a6062c3a31ed78c06ea3a0613a52f2029b2/pkg/authorize/jwt/client_authorizer.go#L78"}],"sourceIdentifier":"secalert@redhat.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-290"}],"source":"secalert@redhat.com","type":"Secondary"}]}
|