redhat openshift data science vulnerabilities

Latest redhat openshift data science CVEs

Newest publication first

1. CVE-2024-7557 Odh-dashboard: odh-model-controller: cross-model authentication bypass in openshift ai

   Published 2024-08-08

   High·CVSS 8.8 EPSS 0.98%

   A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be...

2. CVE-2023-44487 HTTP/2 Stream Cancellation Attack

   Published 2023-10-10

   High·CVSS 7.5 EPSS 100.0% CISA KEV added 2023-10-10 Exploited in the wild Public exploit PoC

   The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

3. CVE-2023-3361 S3 credentials included when exporting elyra notebook

   Published 2023-10-04

   High·CVSS 7.5 EPSS 0.47%

   A flaw was found in Red Hat OpenShift Data Science. When exporting a pipeline from the Elyra notebook pipeline editor as Python DSL or YAML, it reads S3 credentials from the cluster (ds pipeline server) and saves them in plain text in the generated output instead of an ID for a K...

4. CVE-2023-0923 Odh-notebook-controller-container: missing authorization allows for file contents disclosure

   Published 2023-09-15

   Critical·CVSS 9.8 EPSS 0.94%

   A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.