{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Red Hat OpenShift ist eine \"Platform as a Service\" (PaaS) L\u00f6sung zur Bereitstellung von Applikationen in der Cloud.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Logging Subsystem ausnutzen, um Sicherheitsmechanismen zu umgehen und um einen Denial of Service Zustand herbeizuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Appliance",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0069 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0069.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0069 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0069"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1461 vom 2022-04-21",
        "url": "https://access.redhat.com/errata/RHSA-2022:1461"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1356 vom 2022-04-22",
        "url": "https://access.redhat.com/errata/RHSA-2022:1356"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:1545-1 vom 2022-05-05",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-May/010947.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:1762 vom 2022-05-10",
        "url": "https://access.redhat.com/errata/RHSA-2022:1762"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:2217 vom 2022-05-12",
        "url": "https://access.redhat.com/errata/RHSA-2022:2217"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:2216 vom 2022-05-12",
        "url": "https://access.redhat.com/errata/RHSA-2022:2216"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:2218 vom 2022-05-12",
        "url": "https://access.redhat.com/errata/RHSA-2022:2218"
      },
      {
        "category": "external",
        "summary": "AVAYA Security Advisory ASA-2022-061 vom 2022-05-13",
        "url": "https://downloads.avaya.com/css/P8/documents/101081788"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-1762 vom 2022-05-17",
        "url": "https://linux.oracle.com/errata/ELSA-2022-1762.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:4667 vom 2022-05-19",
        "url": "https://access.redhat.com/errata/RHSA-2022:4667"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:4668 vom 2022-05-19",
        "url": "https://access.redhat.com/errata/RHSA-2022:4668"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:2281 vom 2022-05-31",
        "url": "https://access.redhat.com/errata/RHSA-2022:2281"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:2280 vom 2022-05-31",
        "url": "https://access.redhat.com/errata/RHSA-2022:2280"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:5026 vom 2022-06-15",
        "url": "https://access.redhat.com/errata/RHSA-2022:5026"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:2137-1 vom 2022-06-20",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-June/011313.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:2140-1 vom 2022-06-20",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-June/011315.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:2139-1 vom 2022-06-20",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-June/011314.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:5070 vom 2022-08-10",
        "url": "https://access.redhat.com/errata/RHSA-2022:5070"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:5069 vom 2022-08-10",
        "url": "https://access.redhat.com/errata/RHSA-2022:5069"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6042 vom 2022-08-10",
        "url": "https://access.redhat.com/errata/RHSA-2022:6042"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:5068 vom 2022-08-10",
        "url": "https://access.redhat.com/errata/RHSA-2022:5068"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6040 vom 2022-08-10",
        "url": "https://access.redhat.com/errata/RHSA-2022:6040"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6066 vom 2022-08-15",
        "url": "https://www.cybersecurity-help.cz/vdb/SB2022081537"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:2834-1 vom 2022-08-17",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-August/011935.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:2839-1 vom 2022-08-18",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-August/011941.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6051 vom 2022-08-18",
        "url": "https://access.redhat.com/errata/RHSA-2022:6051"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6156 vom 2022-08-24",
        "url": "https://access.redhat.com/errata/RHSA-2022:6156"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6290 vom 2022-09-01",
        "url": "https://access.redhat.com/errata/RHSA-2022:6290"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6430 vom 2022-09-13",
        "url": "https://access.redhat.com/errata/RHSA-2022:6430"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:6537 vom 2022-09-20",
        "url": "https://access.redhat.com/errata/RHSA-2022:6537"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:3745-1 vom 2022-10-26",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-October/012700.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7261 vom 2022-10-31",
        "url": "https://access.redhat.com/errata/RHSA-2022:7261"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7529 vom 2022-11-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:7529"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:7519 vom 2022-11-08",
        "url": "https://access.redhat.com/errata/RHSA-2022:7519"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:8057 vom 2022-11-15",
        "url": "https://access.redhat.com/errata/RHSA-2022:8057"
      },
      {
        "category": "external",
        "summary": "Oracle Linux Security Advisory ELSA-2022-7529 vom 2022-11-15",
        "url": "https://linux.oracle.com/errata/ELSA-2022-7529.html"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2022:9096 vom 2023-01-30",
        "url": "https://access.redhat.com/errata/RHSA-2022:9096"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:0566 vom 2023-02-07",
        "url": "https://access.redhat.com/errata/RHSA-2023:0566"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:0652 vom 2023-02-15",
        "url": "https://access.redhat.com/errata/RHSA-2023:0652"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1158 vom 2023-03-14",
        "url": "https://access.redhat.com/errata/RHSA-2023:1158"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:2014 vom 2023-05-02",
        "url": "https://access.redhat.com/errata/RHSA-2023:2014"
      },
      {
        "category": "external",
        "summary": "Fedora Security Advisory FEDORA-2023-0C6723004F vom 2023-04-29",
        "url": "https://bodhi.fedoraproject.org/updates/FEDORA-2023-0c6723004f"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:1326 vom 2023-05-18",
        "url": "https://access.redhat.com/errata/RHSA-2023:1326"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:5314 vom 2023-09-20",
        "url": "https://access.redhat.com/errata/RHSA-2023:5314"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2023:6818 vom 2023-11-09",
        "url": "https://access.redhat.com/errata/RHSA-2023:6818"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2024:0564 vom 2024-01-30",
        "url": "https://access.redhat.com/errata/RHSA-2024:0564"
      }
    ],
    "source_lang": "en-US",
    "title": "Red Hat OpenShift Logging Subsystem: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-01-30T23:00:00.000+00:00",
      "generator": {
        "date": "2024-02-15T16:45:31.388+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2022-0069",
      "initial_release_date": "2022-04-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2022-04-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2022-05-05T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-05-08T22:00:00.000+00:00",
          "number": "3",
          "summary": "Pr\u00e4zisierung betroffenes Produkt"
        },
        {
          "date": "2022-05-10T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-05-11T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-05-15T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von AVAYA aufgenommen"
        },
        {
          "date": "2022-05-17T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von Oracle Linux aufgenommen"
        },
        {
          "date": "2022-05-18T22:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-05-19T22:00:00.000+00:00",
          "number": "9",
          "summary": "Referenz(en) aufgenommen: 2065755"
        },
        {
          "date": "2022-05-30T22:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-05-31T22:00:00.000+00:00",
          "number": "11",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-06-02T22:00:00.000+00:00",
          "number": "12",
          "summary": "Referenz(en) aufgenommen: FEDORA-2022-396C568C5E"
        },
        {
          "date": "2022-06-14T22:00:00.000+00:00",
          "number": "13",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-06-20T22:00:00.000+00:00",
          "number": "14",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-06-22T22:00:00.000+00:00",
          "number": "15",
          "summary": "Referenz(en) aufgenommen: FEDORA-2022-92EF43C439"
        },
        {
          "date": "2022-08-10T22:00:00.000+00:00",
          "number": "16",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-08-15T22:00:00.000+00:00",
          "number": "17",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-08-17T22:00:00.000+00:00",
          "number": "18",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-08-18T22:00:00.000+00:00",
          "number": "19",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-08-24T22:00:00.000+00:00",
          "number": "20",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-08-31T22:00:00.000+00:00",
          "number": "21",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-09-12T22:00:00.000+00:00",
          "number": "22",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-09-20T22:00:00.000+00:00",
          "number": "23",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-10-23T22:00:00.000+00:00",
          "number": "24",
          "summary": "Referenz(en) aufgenommen: FEDORA-2022-13AD572B5A, FEDORA-2022-739C7A0058, FEDORA-2022-741325E9A0"
        },
        {
          "date": "2022-10-26T22:00:00.000+00:00",
          "number": "25",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-10-31T23:00:00.000+00:00",
          "number": "26",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-11-08T23:00:00.000+00:00",
          "number": "27",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-11-15T23:00:00.000+00:00",
          "number": "28",
          "summary": "Neue Updates von Red Hat und Oracle Linux aufgenommen"
        },
        {
          "date": "2023-01-29T23:00:00.000+00:00",
          "number": "29",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-02-06T23:00:00.000+00:00",
          "number": "30",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-02-14T23:00:00.000+00:00",
          "number": "31",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-03-14T23:00:00.000+00:00",
          "number": "32",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-05-01T22:00:00.000+00:00",
          "number": "33",
          "summary": "Neue Updates von Red Hat und Fedora aufgenommen"
        },
        {
          "date": "2023-05-18T22:00:00.000+00:00",
          "number": "34",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-09-20T22:00:00.000+00:00",
          "number": "35",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2023-11-08T23:00:00.000+00:00",
          "number": "36",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2024-01-30T23:00:00.000+00:00",
          "number": "37",
          "summary": "Neue Updates von Red Hat aufgenommen"
        }
      ],
      "status": "final",
      "version": "37"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Avaya Aura Communication Manager",
            "product": {
              "name": "Avaya Aura Communication Manager",
              "product_id": "T015126",
              "product_identification_helper": {
                "cpe": "cpe:/a:avaya:communication_manager:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Avaya"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Fedora Linux",
            "product": {
              "name": "Fedora Linux",
              "product_id": "74185",
              "product_identification_helper": {
                "cpe": "cpe:/o:fedoraproject:fedora:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Fedora"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Oracle Linux",
            "product": {
              "name": "Oracle Linux",
              "product_id": "T004914",
              "product_identification_helper": {
                "cpe": "cpe:/o:oracle:linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift",
                "product": {
                  "name": "Red Hat OpenShift",
                  "product_id": "T008027",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:-"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Logging Subsystem 5",
                "product": {
                  "name": "Red Hat OpenShift Logging Subsystem 5",
                  "product_id": "T023123",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:5::logging_subsystem"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform \u003c 4.12.1",
                "product": {
                  "name": "Red Hat OpenShift Container Platform \u003c 4.12.1",
                  "product_id": "T025202",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.11",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.11",
                  "product_id": "T025990",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform_4.11"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.13",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.13",
                  "product_id": "T027760",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:container_platform_4.13"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "OpenShift"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-0759",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Red Hat OpenShift in \"kubeclient\", dem Ruby Client f\u00fcr die Kubernetes Rest API. Wird in der Datei \"kubeconfig\" keine benutzerdefinierte CA konfiguriert, akzeptiert \"kubeclient\" jedes Zertifikat. Ein Angreifer kann damit die Zertifikatspr\u00fcfung umgehen und einen Man-in-the-Middle-Angriff durchf\u00fchren. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T008027",
          "T002207",
          "67646",
          "T025202",
          "T023123",
          "T004914",
          "T025990",
          "74185",
          "T027760"
        ]
      },
      "release_date": "2022-04-21T22:00:00Z",
      "title": "CVE-2022-0759"
    },
    {
      "cve": "CVE-2022-21698",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Red Hat OpenShift. In \"prometheus/client_golang\" kann die Funktion \"InstrumentHandlerCounter\" missbr\u00e4uchlich genutzt werden, um einen Denial of Service Zustand herbeizuf\u00fchren. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Zustand herbeizuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T008027",
          "T002207",
          "67646",
          "T025202",
          "T023123",
          "T015126",
          "T004914",
          "T025990",
          "74185",
          "T027760"
        ]
      },
      "release_date": "2022-04-21T22:00:00Z",
      "title": "CVE-2022-21698"
    }
  ]
}