Read the docs
TI-2024-11674 Aliases CVE-2024-12582GHSA-jwxc-5ch3-vxqq

Skupper: skupper-cli: flawed authentication method may lead to arbitrary file read or denial of service

Priority LOW 32CWE-305Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

A flaw was found in the skupper console, a read-only interface that renders cluster network, traffic details, and metrics for a network application that a user sets up across a hybrid multi-cloud environment. When the default authentication method is used, a random password is generated for the "admin" user and is persisted in either a Kubernetes secret or a podman volume in a plaintext file. This authentication method can be manipulated by an attacker, leading to the reading of any user-readable file in the container filesystem, directly impacting data confidentiality. Additionally, the attacker may induce skupper to read extremely large files into memory, resulting in resource exhaustion and a denial of service attack.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00514 44th percentileScored 2026-11-07
Fix Fixed skupper: 1.8.3Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—skupperbefore 1.8.31.8.3Patch availableCNA
Red HatService Interconnect 1 for RHEL 9—1.8.3-1Patch availableCNA
Red HatService Interconnect 1 for RHEL 9—1.8.3-1Patch availableCNA
Red HatService Interconnect 1 for RHEL 9—1.8.3-1Patch availableCNA
Red HatService Interconnect 1 for RHEL 9—1.8.3-1Patch availableCNA
Red HatService Interconnect 1 for RHEL 9—1.8.3-1Patch availableCNA
Red HatService Interconnect 1 for RHEL 9—2.7.3-1Patch availableCNA
Red HatService Interconnect 1 for RHEL 9—1.8.3-1Patch availableCNA
Red HatService Interconnect 1 for RHEL 9—1.8.3-1Patch availableCNA
Red HatRed Hat Service Interconnect 1——Not affectedCNA
  • skupper Vendor— Affected before 1.8.3 Fixed in 1.8.3 Patch available CNA
  • Service Interconnect 1 for RHEL 9 VendorRed Hat Affected — Fixed in 1.8.3-1 Patch available CNA
  • Service Interconnect 1 for RHEL 9 VendorRed Hat Affected — Fixed in 1.8.3-1 Patch available CNA
  • Service Interconnect 1 for RHEL 9 VendorRed Hat Affected — Fixed in 1.8.3-1 Patch available CNA
  • Service Interconnect 1 for RHEL 9 VendorRed Hat Affected — Fixed in 1.8.3-1 Patch available CNA
  • Service Interconnect 1 for RHEL 9 VendorRed Hat Affected — Fixed in 1.8.3-1 Patch available CNA
  • Service Interconnect 1 for RHEL 9 VendorRed Hat Affected — Fixed in 2.7.3-1 Patch available CNA
  • Service Interconnect 1 for RHEL 9 VendorRed Hat Affected — Fixed in 1.8.3-1 Patch available CNA
  • Service Interconnect 1 for RHEL 9 VendorRed Hat Affected — Fixed in 1.8.3-1 Patch available CNA
  • Red Hat Service Interconnect 1 VendorRed Hat Affected — Fixed in — Not affected CNA

CPE names CNA · 2

CPEVersionsRoleVendor
cpe:/a:redhat:service_interconnect:1::el91—Red Hat
cpe:/a:redhat:service_interconnect:11—Red Hat
  • cpe:/a:redhat:service_interconnect:1::el9 Versions 1 — ·Red Hat
  • cpe:/a:redhat:service_interconnect:1 Versions 1 — ·Red Hat

Remediation

  • Fix · CNA skupper Fixed in 1.8.3

Red Hat 1 advisory

  • RHSA-2025:1413 Released 2025-02-13 · Red Hat rating Important
    Updated service-interconnect rhel9 container images for 1.8
    • Red Hat Service Interconnect 1 service-interconnect/skupper-config-sync-rhel9, service-interconnect/skupper-controller-podman-container-rhel9, service-interconnect/skupper-controller-podman-rhel9 +5

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Service Interconnect 1Fixed RHSA-2025:1413
Not affected: 1 product
  • Red Hat Service Interconnect 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-12582
  2. 2026-10-03 Alias added: GHSA-jwxc-5ch3-vxqq

References

Advisory 1

Other 3

  • TI-2019-15875 Protection mechanism failure in Jenkins Pipeline: Groovy Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-15874 Protection mechanism failure in Jenkins Script Security Plugin KEVCVSS 3.1CRITICAL 9.9
  • TI-2019-08259 Underflow in PHP-FPM can lead to RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2019-05363 Code injection in Elastic Kibana KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-03949 Out-of-bounds write in ESXi and Horizon DaaS KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-16080 A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153… KEVCVSS 3.1CRITICAL 9.8
See all 7413 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences