Red Hat Security AdvisoryRHSA-2020:0972
Red Hat OpenShift Service Mesh 1.0.10 Jaeger and Kiali security update
Released 2020-03-25 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenShift Service Mesh 1.0 jaeger-v1.13.1.redhat6-1.el7, kiali-v1.0.10.redhat1-1.el7
Fixes 2 records
Priority MEDIUM 40
An insufficient JWT validation vulnerability was found in Kiali versions 0.4.0 to 1.15.0 and was fixed in Kiali version 1.15.1, wherein a remote attacker could abuse this flaw by stealing a valid JWT cookie and using tha…
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.01153 · Published 2020-04-27 · Fixed in 1.15.1 CWE-384
Priority LOW 27
Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01652 · Published 2020-02-04 · Partial fix · 1.4.5 CWE-20
