Red Hat Bug Fix Advisory: updated RHDH-1.1-RHEL-9 container images
Updated RHDH-1.1-RHEL-9 container images are now available
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-6944US | medium5.7 | — | ||
A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- Fixedrhdh/rhdh-hub-rhel9@sha256:34da2c4b49b756d8e1eab4c2974aaf8f0f7eb2360574c51e91126e171fbcc355_amd64 as a component of RHDH 1.1 for RHEL 9
The RHDH-1.1-RHEL-9 container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References). Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.
https://access.redhat.com/errata/RHBA-2024:5869 - Workaroundrhdh/rhdh-hub-rhel9@sha256:34da2c4b49b756d8e1eab4c2974aaf8f0f7eb2360574c51e91126e171fbcc355_amd64 as a component of RHDH 1.1 for RHEL 9
To mitigate this vulnerability until you can update to RHDH 1.1, ensure that the base64 encoded GitLab token does not contain a newline character at the end. Removing the newline from the token prevents the unintended disclosure of the access token through the frontend.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan