CVE-2024-6535: Skupper uses a static cookie secret for the openshift oauth-proxy
(updated )
A flaw was found in Skupper. When Skupper is initialized with the console-enabled and with console-auth set to Openshift, it configures the openshift oauth-proxy with a static cookie-secret. In certain circumstances, this may allow an attacker to bypass authentication to the Skupper console via a specially-crafted cookie.
References
- access.redhat.com/errata/RHSA-2024:4865
- access.redhat.com/errata/RHSA-2024:4871
- access.redhat.com/security/cve/CVE-2024-6535
- bugzilla.redhat.com/show_bug.cgi?id=2296024
- github.com/advisories/GHSA-w799-v85j-88pg
- github.com/skupperproject/skupper
- github.com/skupperproject/skupper/commit/d2cb3782e807853694ee66b6e3d4a1917485eb71
- nvd.nist.gov/vuln/detail/CVE-2024-6535
Code Behaviors & Features
Detect and mitigate CVE-2024-6535 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →