Описание
HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.
In consul a specially crafted KV (key/value store) entry could be used by attacker to perform a XSS (Cross Site Scripting) attack when viewed in the raw mode.
Отчет
OpenShift Container Platform (OCP) and OpenShift Service Mesh (OSSM) components ship only consul api which could be used for connection to consul service mesh solution, therefore are not affected by this flaw. Some OpenShift Virtualization components reference consul in go.sum files, however none of the projects or container images depend on or ship consul, therefore are not affected by this flaw.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| OpenShift Service Mesh 2.0 | servicemesh | Not affected | ||
| OpenShift Service Mesh 2.0 | servicemesh-prometheus | Not affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/metrics-collector-rhel9 | Not affected | ||
| Red Hat Advanced Cluster Management for Kubernetes 2 | rhacm2/multicluster-observability-rhel8-operator | Not affected | ||
| Red Hat Fuse 7 | consul-client | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/cnf-tests-rhel8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/compliance-rhel8-operator | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/file-integrity-rhel8-operator | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-baremetal-machine-controllers | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-cluster-etcd-rhel8-operator | Not affected |
Показывать по
Дополнительная информация
Статус:
6.1 Medium
CVSS3
Связанные уязвимости
HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.
HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.
HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value ( ...
HashiCorp Consul Cross-site Scripting vulnerability
6.1 Medium
CVSS3