CVE-2024-6508: Openshift Console insufficient entropy vulnerability
(updated )
An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions.
References
- access.redhat.com/errata/RHSA-2024:10813
- access.redhat.com/errata/RHSA-2024:7922
- access.redhat.com/errata/RHSA-2024:8415
- access.redhat.com/errata/RHSA-2024:8991
- access.redhat.com/errata/RHSA-2024:9620
- access.redhat.com/errata/RHSA-2025:0014
- access.redhat.com/security/cve/CVE-2024-6508
- bugzilla.redhat.com/show_bug.cgi?id=2295777
- github.com/advisories/GHSA-4crf-28c7-v4gr
- github.com/openshift/console
- nvd.nist.gov/vuln/detail/CVE-2024-6508
Code Behaviors & Features
Detect and mitigate CVE-2024-6508 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →