Skip to content

Commit 31fbe42

Browse files
author
cvelistV5 Github Action
committed
2 changes (2 new | 0 updated):
 - 2 new CVEs: CVE-2024-10973, CVE-2024-9779 - 0 updated CVEs:
1 parent cc27e78 commit 31fbe42

File tree

4 files changed

+335
-18
lines changed

4 files changed

+335
-18
lines changed

‎cves/2024/10xxx/CVE-2024-10973.json

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.1",
4+
"cveMetadata": {
5+
"cveId": "CVE-2024-10973",
6+
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
7+
"state": "PUBLISHED",
8+
"assignerShortName": "redhat",
9+
"dateReserved": "2024-11-07T16:42:52.079Z",
10+
"datePublished": "2024-12-17T22:59:38.518Z",
11+
"dateUpdated": "2024-12-17T22:59:38.518Z"
12+
},
13+
"containers": {
14+
"cna": {
15+
"title": "Keycloak: cli option for encrypted jgroups ignored",
16+
"metrics": [
17+
{
18+
"other": {
19+
"content": {
20+
"value": "Moderate",
21+
"namespace": "https://access.redhat.com/security/updates/classification/"
22+
},
23+
"type": "Red Hat severity rating"
24+
}
25+
},
26+
{
27+
"cvssV3_1": {
28+
"attackComplexity": "LOW",
29+
"attackVector": "ADJACENT_NETWORK",
30+
"availabilityImpact": "NONE",
31+
"baseScore": 5.7,
32+
"baseSeverity": "MEDIUM",
33+
"confidentialityImpact": "HIGH",
34+
"integrityImpact": "NONE",
35+
"privilegesRequired": "LOW",
36+
"scope": "UNCHANGED",
37+
"userInteraction": "NONE",
38+
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
39+
"version": "3.1"
40+
},
41+
"format": "CVSS"
42+
}
43+
],
44+
"descriptions": [
45+
{
46+
"lang": "en",
47+
"value": "A vulnerability was found in Keycloak. The environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text which can allow an attacker that has access to adjacent networks related to JGroups to read sensitive information."
48+
}
49+
],
50+
"affected": [
51+
{
52+
"versions": [
53+
{
54+
"status": "unaffected",
55+
"version": "22.0",
56+
"lessThan": "23.0",
57+
"versionType": "semver"
58+
},
59+
{
60+
"status": "unaffected",
61+
"version": "24.0",
62+
"lessThan": "25.0",
63+
"versionType": "semver"
64+
},
65+
{
66+
"status": "unaffected",
67+
"version": "26.0.6",
68+
"lessThan": "*",
69+
"versionType": "semver"
70+
}
71+
],
72+
"packageName": "keycloak",
73+
"collectionURL": "https://github.com/keycloak/keycloak",
74+
"defaultStatus": "affected"
75+
},
76+
{
77+
"vendor": "Red Hat",
78+
"product": "Red Hat Build of Keycloak",
79+
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
80+
"packageName": "org.keycloak/keycloak-quarkus-server",
81+
"defaultStatus": "unaffected",
82+
"cpes": [
83+
"cpe:/a:redhat:build_keycloak:"
84+
]
85+
},
86+
{
87+
"vendor": "Red Hat",
88+
"product": "Red Hat JBoss Enterprise Application Platform 8",
89+
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
90+
"packageName": "org.keycloak/keycloak-quarkus-server",
91+
"defaultStatus": "unaffected",
92+
"cpes": [
93+
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
94+
]
95+
},
96+
{
97+
"vendor": "Red Hat",
98+
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
99+
"collectionURL": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html",
100+
"packageName": "org.keycloak/keycloak-quarkus-server",
101+
"defaultStatus": "unaffected",
102+
"cpes": [
103+
"cpe:/a:redhat:jbosseapxp"
104+
]
105+
}
106+
],
107+
"references": [
108+
{
109+
"url": "https://access.redhat.com/security/cve/CVE-2024-10973",
110+
"tags": [
111+
"vdb-entry",
112+
"x_refsource_REDHAT"
113+
]
114+
},
115+
{
116+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2324361",
117+
"name": "RHBZ#2324361",
118+
"tags": [
119+
"issue-tracking",
120+
"x_refsource_REDHAT"
121+
]
122+
}
123+
],
124+
"datePublic": "2024-11-07T00:00:00+00:00",
125+
"problemTypes": [
126+
{
127+
"descriptions": [
128+
{
129+
"cweId": "CWE-319",
130+
"description": "Cleartext Transmission of Sensitive Information",
131+
"lang": "en",
132+
"type": "CWE"
133+
}
134+
]
135+
}
136+
],
137+
"x_redhatCweChain": "CWE-319: Cleartext Transmission of Sensitive Information",
138+
"timeline": [
139+
{
140+
"lang": "en",
141+
"time": "2024-11-07T12:09:22.885000+00:00",
142+
"value": "Reported to Red Hat."
143+
},
144+
{
145+
"lang": "en",
146+
"time": "2024-11-07T00:00:00+00:00",
147+
"value": "Made public."
148+
}
149+
],
150+
"credits": [
151+
{
152+
"lang": "en",
153+
"value": "Red Hat would like to thank philliphnguyen for reporting this issue."
154+
}
155+
],
156+
"providerMetadata": {
157+
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
158+
"shortName": "redhat",
159+
"dateUpdated": "2024-12-17T22:59:38.518Z"
160+
}
161+
}
162+
}
163+
}

‎cves/2024/9xxx/CVE-2024-9779.json

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
{
2+
"dataType": "CVE_RECORD",
3+
"dataVersion": "5.1",
4+
"cveMetadata": {
5+
"cveId": "CVE-2024-9779",
6+
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
7+
"state": "PUBLISHED",
8+
"assignerShortName": "redhat",
9+
"dateReserved": "2024-10-10T03:51:08.007Z",
10+
"datePublished": "2024-12-17T22:59:07.511Z",
11+
"dateUpdated": "2024-12-17T22:59:07.511Z"
12+
},
13+
"containers": {
14+
"cna": {
15+
"title": "Open-cluster-management-io/ocm: cluster-manager permissions may allow a worker node to obtain service account tokens",
16+
"metrics": [
17+
{
18+
"other": {
19+
"content": {
20+
"value": "Moderate",
21+
"namespace": "https://access.redhat.com/security/updates/classification/"
22+
},
23+
"type": "Red Hat severity rating"
24+
}
25+
},
26+
{
27+
"cvssV3_1": {
28+
"attackComplexity": "HIGH",
29+
"attackVector": "NETWORK",
30+
"availabilityImpact": "NONE",
31+
"baseScore": 7.5,
32+
"baseSeverity": "HIGH",
33+
"confidentialityImpact": "LOW",
34+
"integrityImpact": "HIGH",
35+
"privilegesRequired": "NONE",
36+
"scope": "CHANGED",
37+
"userInteraction": "NONE",
38+
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N",
39+
"version": "3.1"
40+
},
41+
"format": "CVSS"
42+
}
43+
],
44+
"descriptions": [
45+
{
46+
"lang": "en",
47+
"value": "A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name \"cluster-manager\" which is bound to a ClusterRole also named \"cluster-manager\", which includes the permission to create Pod resources. If this deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager's token and steal any service account token by creating and mounting the target service account to control the whole cluster."
48+
}
49+
],
50+
"affected": [
51+
{
52+
"versions": [
53+
{
54+
"status": "affected",
55+
"version": "0.12.0"
56+
},
57+
{
58+
"status": "unaffected",
59+
"version": "0.13.0"
60+
}
61+
],
62+
"packageName": "open-cluster-management-io",
63+
"collectionURL": "https://github.com/open-cluster-management-io"
64+
},
65+
{
66+
"vendor": "Red Hat",
67+
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
68+
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
69+
"packageName": "open-cluster-management",
70+
"defaultStatus": "unaffected",
71+
"cpes": [
72+
"cpe:/a:redhat:acm:2"
73+
]
74+
}
75+
],
76+
"references": [
77+
{
78+
"url": "https://access.redhat.com/security/cve/CVE-2024-9779",
79+
"tags": [
80+
"vdb-entry",
81+
"x_refsource_REDHAT"
82+
]
83+
},
84+
{
85+
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2317916",
86+
"name": "RHBZ#2317916",
87+
"tags": [
88+
"issue-tracking",
89+
"x_refsource_REDHAT"
90+
]
91+
},
92+
{
93+
"url": "https://github.com/open-cluster-management-io/ocm/pull/325"
94+
},
95+
{
96+
"url": "https://github.com/open-cluster-management-io/ocm/releases/tag/v0.13.0"
97+
},
98+
{
99+
"url": "https://github.com/open-cluster-management-io/registration-operator/issues/361"
100+
}
101+
],
102+
"datePublic": "2023-11-30T00:00:00+00:00",
103+
"problemTypes": [
104+
{
105+
"descriptions": [
106+
{
107+
"cweId": "CWE-501",
108+
"description": "Trust Boundary Violation",
109+
"lang": "en",
110+
"type": "CWE"
111+
}
112+
]
113+
}
114+
],
115+
"x_redhatCweChain": "CWE-268->CWE-501: Privilege Chaining leads to Trust Boundary Violation",
116+
"timeline": [
117+
{
118+
"lang": "en",
119+
"time": "2024-10-10T18:03:03.097000+00:00",
120+
"value": "Reported to Red Hat."
121+
},
122+
{
123+
"lang": "en",
124+
"time": "2023-11-30T00:00:00+00:00",
125+
"value": "Made public."
126+
}
127+
],
128+
"credits": [
129+
{
130+
"lang": "en",
131+
"value": "Red Hat would like to thank Nanzi Yang and Xingyu Liu for reporting this issue."
132+
}
133+
],
134+
"providerMetadata": {
135+
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
136+
"shortName": "redhat",
137+
"dateUpdated": "2024-12-17T22:59:07.511Z"
138+
}
139+
}
140+
}
141+
}

‎cves/delta.json

Lines changed: 11 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,20 @@
11
{
2-
"fetchTime": "2024-12-17T21:49:59.751Z",
3-
"numberOfChanges": 3,
2+
"fetchTime": "2024-12-17T23:05:29.329Z",
3+
"numberOfChanges": 2,
44
"new": [
55
{
6-
"cveId": "CVE-2024-51175",
7-
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-51175",
8-
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/51xxx/CVE-2024-51175.json",
9-
"dateUpdated": "2024-12-17T21:47:59.815355"
6+
"cveId": "CVE-2024-10973",
7+
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-10973",
8+
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/10xxx/CVE-2024-10973.json",
9+
"dateUpdated": "2024-12-17T22:59:38.518Z"
1010
},
1111
{
12-
"cveId": "CVE-2024-52792",
13-
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-52792",
14-
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/52xxx/CVE-2024-52792.json",
15-
"dateUpdated": "2024-12-17T21:46:27.319Z"
16-
}
17-
],
18-
"updated": [
19-
{
20-
"cveId": "CVE-2024-1394",
21-
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-1394",
22-
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/1xxx/CVE-2024-1394.json",
23-
"dateUpdated": "2024-12-17T21:47:17.516Z"
12+
"cveId": "CVE-2024-9779",
13+
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-9779",
14+
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9779.json",
15+
"dateUpdated": "2024-12-17T22:59:07.511Z"
2416
}
2517
],
18+
"updated": [],
2619
"error": []
2720
}

‎cves/deltaLog.json

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,24 @@
11
[
2+
{
3+
"fetchTime": "2024-12-17T23:05:29.329Z",
4+
"numberOfChanges": 2,
5+
"new": [
6+
{
7+
"cveId": "CVE-2024-10973",
8+
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-10973",
9+
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/10xxx/CVE-2024-10973.json",
10+
"dateUpdated": "2024-12-17T22:59:38.518Z"
11+
},
12+
{
13+
"cveId": "CVE-2024-9779",
14+
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2024-9779",
15+
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2024/9xxx/CVE-2024-9779.json",
16+
"dateUpdated": "2024-12-17T22:59:07.511Z"
17+
}
18+
],
19+
"updated": [],
20+
"error": []
21+
},
222
{
323
"fetchTime": "2024-12-17T21:49:59.751Z",
424
"numberOfChanges": 3,

0 commit comments

Comments
 (0)