Red Hat Bug Fix Advisory: updated RHDH-1.1-RHEL-9 container images
Updated RHDH-1.1-RHEL-9 container images are now available
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-6944US | medium5.7 | — | ||
A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-import function leaks GitLab access tokens on the frontend when the base64 encoded GitLab token includes a newline… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- Behobenrhdh/rhdh-hub-rhel9@sha256:34da2c4b49b756d8e1eab4c2974aaf8f0f7eb2360574c51e91126e171fbcc355_amd64 as a component of RHDH 1.1 for RHEL 9
The RHDH-1.1-RHEL-9 container images provided by this update can be downloaded from the Red Hat Container Registry at registry.access.redhat.com. Installation instructions for your platform are available at Red Hat Container Catalog (see References). Dockerfiles and scripts should be amended either to refer to this new image specifically, or to the latest image generally.
https://access.redhat.com/errata/RHBA-2024:5869 - Workaroundrhdh/rhdh-hub-rhel9@sha256:34da2c4b49b756d8e1eab4c2974aaf8f0f7eb2360574c51e91126e171fbcc355_amd64 as a component of RHDH 1.1 for RHEL 9
To mitigate this vulnerability until you can update to RHDH 1.1, ensure that the base64 encoded GitLab token does not contain a newline character at the end. Removing the newline from the token prevents the unintended disclosure of the access token through the frontend.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan