CVE-2025-14443

Отчет

The Red Hat Product Security team has assessed the severity of this vulnerability as moderate, due to the ability of authenticated users to trigger arbitrary outbound network connections from the OpenShift API server. Successful exploitation allows attackers to enumerate internal cluster services, probe private network infrastructure, and potentially access cloud metadata services in public cloud deployments. However, most if not all confidential endpoints are still protected due to requiring authentication tokens. The root cause is a default value of "allow-all" in the whitelist of allowed image registries. insufficient validation of IP addresses, network ranges, and domain. during image import processing, resulting in an SSRF condition within a core control-plane component.

Меры по смягчению последствий

Possible mitigations for this flaw include:

• removing the permissions that allow users to use the ImageStreamImport feature or explicitly only allowing trusted users to access the feature.
• explicitly set the apiserver's ImageStreamImport allow-list to trusted image registries. (i.e. oc patch image.config.openshift.io/cluster --type=merge -p '{"spec":{"allowedRegistriesForImport":[{"domainName": "docker.io"}, {"domainName": "quay.io"}]}}')
• Set the apiserver's ImageStreamImport to deny all uses. (oc patch image.config.openshift.io/cluster --type=merge -p '{"spec":{"allowedRegistriesForImport":[{"domainName": "-"}]}}')