CVE-2024-12582
Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service
A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the "admin" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.
Reserved 2024-12-12 | Published 2024-12-24 | Updated 2025-05-16 | Assigner redhatAuthentication Bypass by Primary Weakness
| 2024-12-20: | Reported to Red Hat. |
| 2024-12-20: | Made public. |
access.redhat.com/errata/RHSA-2025:1413 (RHSA-2025:1413)
access.redhat.com/security/cve/CVE-2024-12582
bugzilla.redhat.com/show_bug.cgi?id=2333540 (RHBZ#2333540)
Support options
