CVE-2020-16251

Related Files

Red Hat Security Advisory 2023-3742-02

Posted Jun 23, 2023

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-3742-02 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, and remote SQL injection vulnerabilities.

tags | advisory, remote, denial of service, vulnerability, sql injection

systems | linux, redhat

advisories | CVE-2015-20107, CVE-2018-25032, CVE-2020-10735, CVE-2020-16250, CVE-2020-16251, CVE-2020-17049, CVE-2021-28861, CVE-2021-3765, CVE-2021-3807, CVE-2021-4231, CVE-2021-4235, CVE-2021-4238, CVE-2021-43519, CVE-2021-43998

SHA-256 | 80569651d5cc8033bbdb7f6416fafc8f5509382decbdaab9937ba65ff11a16de

Download | Favorite | View

Red Hat Security Advisory 2023-2138-01

Posted May 18, 2023

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-2138-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the extra low-latency container images for Red Hat OpenShift Container Platform 4.13. Issues addressed include a bypass vulnerability.

tags | advisory, bypass

systems | linux, redhat

advisories | CVE-2020-16251, CVE-2021-43998

SHA-256 | b79395754ba21855cd5d5031d58d1663e08942e2e0206b476363246f24bf8b51

Download | Favorite | View

Hashicorp Vault GCP IAM Integration Authentication Bypass

Posted Oct 6, 2020

Authored by Google Security Research, Felix Wilhelm

HashiCorp Vault's GCP authentication method can be bypassed on gce type roles that do not specify bound_service_accounts. Vault does not enforce that the compute_engine data in a signed JWT token has any relationship to the service account that created the token. This makes it possible to impersonate arbitrary GCE instances, by creating a JWT token with a faked compute_engine struct, using an arbitrary attacker controlled service account.

tags | exploit, arbitrary

advisories | CVE-2020-16251

SHA-256 | 34f611b87b68b7fd6cab37412c7d4092e8b5a0d5ec0b29df2c510e9bc1a45ab4

Download | Favorite | View