OpenShift image-customization-controller exposes cluster pull secret without authentication
Anyone on the same network can steal your cluster passwords.
Summary
The image-customization-controller in OpenShift's bare metal provisioning stack serves images and a directory listing without authentication. An attacker on the provisioning network can recover the cluster pull secret and SSH key.
Affected when
- Bare metal provisioning stack in use
What to do
We have not confirmed a fixed version yet. Check the source links below.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen