csaf_certbund - wid-sec-w-2024-3488

wid-sec-w-2024-3488

Vulnerability from csaf_certbund

Published

2024-11-18 23:00

Modified

2024-12-04 23:00

Summary

Red Hat OpenShift Container Platform: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Red Hat OpenShift ist eine "Platform as a Service" (PaaS) Lösung zur Bereitstellung von Applikationen in der Cloud.

Angriff

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.

Betroffene Betriebssysteme

- Linux

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Red Hat OpenShift ist eine \"Platform as a Service\" (PaaS) L\u00f6sung zur Bereitstellung von Applikationen in der Cloud.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3488 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3488.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3488 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3488"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:9613 vom 2024-11-18",
        "url": "https://access.redhat.com/errata/RHSA-2024:9613"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:9623 vom 2024-11-20",
        "url": "https://access.redhat.com/errata/RHSA-2024:9623"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:9618 vom 2024-11-20",
        "url": "https://access.redhat.com/errata/RHSA-2024:9618"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10145 vom 2024-11-26",
        "url": "https://access.redhat.com/errata/RHSA-2024:10145"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:10535 vom 2024-12-05",
        "url": "https://access.redhat.com/errata/RHSA-2024:10535"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat OpenShift Container Platform: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-12-04T23:00:00.000+00:00",
      "generator": {
        "date": "2024-12-05T09:06:05.070+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2024-3488",
      "initial_release_date": "2024-11-18T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-11-18T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-11-19T23:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-11-25T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-12-04T23:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.17.5",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.17.5",
                  "product_id": "T039244"
                }
              },
              {
                "category": "product_version",
                "name": "Container Platform 4.17.5",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.17.5",
                  "product_id": "T039244-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.17.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.16.23",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.16.23",
                  "product_id": "T039272"
                }
              },
              {
                "category": "product_version",
                "name": "Container Platform 4.16.23",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.16.23",
                  "product_id": "T039272-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.16.23"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.14.41",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.14.41",
                  "product_id": "T039273"
                }
              },
              {
                "category": "product_version",
                "name": "Container Platform 4.14.41",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.14.41",
                  "product_id": "T039273-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.14.41"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "Container Platform \u003c4.15.39",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c4.15.39",
                  "product_id": "T039437"
                }
              },
              {
                "category": "product_version",
                "name": "Container Platform 4.15.39",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.15.39",
                  "product_id": "T039437-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform__4.15.39"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenShift"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-49768",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Red Hat OpenShift Container Platform. Im Waitress-WSGI-Server f\u00fcr Python kommt es unter bestimmten Umst\u00e4nden bei der Verarbeitung von Anfragen im HTTP-Pipelining mit ung\u00fcltiger erster Anfrage zu einer Race-Condition. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039273",
          "67646",
          "T039272",
          "T039437",
          "T039244"
        ]
      },
      "release_date": "2024-11-18T23:00:00.000+00:00",
      "title": "CVE-2024-49768"
    },
    {
      "cve": "CVE-2024-49769",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Red Hat OpenShift Container Platform. Ein Problem im Waitress-WSGI-Server f\u00fcr Python f\u00fchrt unter bestimmten Umst\u00e4nden zu einer Endlosschleife. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service zu verursachen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T039273",
          "67646",
          "T039272",
          "T039437",
          "T039244"
        ]
      },
      "release_date": "2024-11-18T23:00:00.000+00:00",
      "title": "CVE-2024-49769"
    }
  ]
}

cve-2024-49769

Vulnerability from cvelistv5

Published

2024-10-29 14:18

Modified

2024-11-17 00:11

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Waitress has a denial of service leading to high CPU usage/resource exhaustion

References

▼	URL	Tags
	https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6	x_refsource_CONFIRM
	https://github.com/Pylons/waitress/issues/418	x_refsource_MISC
	https://github.com/Pylons/waitress/pull/435	x_refsource_MISC
	https://github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95c	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Pylons

waitress

Version: < 3.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:pylons:waitress:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "waitress",
            "vendor": "pylons",
            "versions": [
              {
                "lessThan": "3.0.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49769",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-29T14:56:24.506825Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-29T14:56:55.296Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-11-17T00:11:26.954Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/11/msg00012.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "waitress",
          "vendor": "Pylons",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Waitress is a Web Server Gateway Interface server for Python 2 and 3. When a remote client closes the connection before waitress has had the opportunity to call getpeername() waitress won\u0027t correctly clean up the connection leading to the main thread attempting to write to a socket that no longer exists, but not removing it from the list of sockets to attempt to process. This leads to a busy-loop calling the write function. A remote attacker could run waitress out of available sockets with very little resources required. Waitress 3.0.1 contains fixes that remove the race condition."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-772",
              "description": "CWE-772: Missing Release of Resource after Effective Lifetime",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-29T14:18:40.951Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Pylons/waitress/security/advisories/GHSA-3f84-rpwh-47g6"
        },
        {
          "name": "https://github.com/Pylons/waitress/issues/418",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Pylons/waitress/issues/418"
        },
        {
          "name": "https://github.com/Pylons/waitress/pull/435",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Pylons/waitress/pull/435"
        },
        {
          "name": "https://github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Pylons/waitress/commit/1ae4e894c9f76543bee06584001583fc6fa8c95c"
        }
      ],
      "source": {
        "advisory": "GHSA-3f84-rpwh-47g6",
        "discovery": "UNKNOWN"
      },
      "title": "Waitress has a denial of service leading to high CPU usage/resource exhaustion"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-49769",
    "datePublished": "2024-10-29T14:18:40.951Z",
    "dateReserved": "2024-10-18T13:43:23.457Z",
    "dateUpdated": "2024-11-17T00:11:26.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2024-49768

Vulnerability from cvelistv5

Published

2024-10-29 14:32

Modified

2024-10-29 14:56

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

Waitress has request processing race condition in HTTP pipelining with invalid first request

References

▼	URL	Tags
	https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj	x_refsource_CONFIRM
	https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Pylons

waitress

Version: >= 2.0.0, < 3.0.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:pylons:waitress:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "waitress",
            "vendor": "pylons",
            "versions": [
              {
                "lessThan": "3.0.1",
                "status": "affected",
                "version": "2.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49768",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-29T14:54:02.750759Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-29T14:56:02.111Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "waitress",
          "vendor": "Pylons",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.0.0, \u003c 3.0.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Waitress is a Web Server Gateway Interface server for Python 2 and 3. A remote client may send a request that is exactly recv_bytes (defaults to 8192) long, followed by a secondary request using HTTP pipelining. When request lookahead is disabled (default) we won\u0027t read any more requests, and when the first request fails due to a parsing error, we simply close the connection. However when request lookahead is enabled, it is possible to process and receive the first request, start sending the error message back to the client while we read the next request and queue it. This will allow the secondary request to be serviced by the worker thread while the connection should be closed. Waitress 3.0.1 fixes the race condition. As a workaround, disable channel_request_lookahead, this is set to 0 by default disabling this feature."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-367",
              "description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-444",
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-29T14:32:25.164Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Pylons/waitress/security/advisories/GHSA-9298-4cf8-g4wj"
        },
        {
          "name": "https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Pylons/waitress/commit/e4359018537af376cf24bd13616d861e2fb76f65"
        }
      ],
      "source": {
        "advisory": "GHSA-9298-4cf8-g4wj",
        "discovery": "UNKNOWN"
      },
      "title": "Waitress has request processing race condition in HTTP pipelining with invalid first request"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-49768",
    "datePublished": "2024-10-29T14:32:25.164Z",
    "dateReserved": "2024-10-18T13:43:23.457Z",
    "dateUpdated": "2024-10-29T14:56:02.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

wid-sec-w-2024-3488

Vulnerability from csaf_certbund

cve-2024-49769

Vulnerability from cvelistv5

cve-2024-49768

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature