CVE-2022-3248: Openshift api admission checks does not enforce "custom-host" permissions
A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied.
Other sources
The ability to specify a custom host name is governed by the "custom-host" permission, which is granted by default to all project administrators[1]. It is possible for the cluster administrator to revoke this permission. Then, the OpenShift API admission checks should prohibit project administrators from setting a custom host name on ingress and route objects. The problem is that the admission checks do not enforce this prohibition for ingress objects under some circumstances.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-3248?
CVE-2022-3248 is a vulnerability found in OpenShift API, allowing an attacker to violate boundaries by bypassing permissions.
How severe is CVE-2022-3248?
CVE-2022-3248 has a severity rating of 7.5 (high).
Which software is affected by CVE-2022-3248?
Redhat Advanced Cluster Management for Kubernetes 2.0 and Redhat Openshift Container Platform 4.0 are affected by CVE-2022-3248.
What is the Common Weakness Enumeration (CWE) ID for CVE-2022-3248?
The Common Weakness Enumeration (CWE) ID for CVE-2022-3248 is CWE-863.
How can I fix CVE-2022-3248?
To fix CVE-2022-3248, it is recommended to apply the necessary patches or updates provided by Redhat.