CVE-2020-16250

Related Files

Red Hat Security Advisory 2023-3742-02

Posted Jun 23, 2023

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-3742-02 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, and remote SQL injection vulnerabilities.

tags | advisory, remote, denial of service, vulnerability, sql injection

systems | linux, redhat

advisories | CVE-2015-20107, CVE-2018-25032, CVE-2020-10735, CVE-2020-16250, CVE-2020-16251, CVE-2020-17049, CVE-2021-28861, CVE-2021-3765, CVE-2021-3807, CVE-2021-4231, CVE-2021-4235, CVE-2021-4238, CVE-2021-43519, CVE-2021-43998

SHA-256 | 80569651d5cc8033bbdb7f6416fafc8f5509382decbdaab9937ba65ff11a16de

Download | Favorite | View

Red Hat Security Advisory 2023-3342-01

Posted Jun 22, 2023

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-3342-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the extra low-latency container images for Red Hat OpenShift Container Platform 4.13. Issues addressed include a bypass vulnerability.

tags | advisory, bypass

systems | linux, redhat

advisories | CVE-2020-16250, CVE-2022-36227, CVE-2023-0361, CVE-2023-27535

SHA-256 | 5813a13210ed8e54dc4702cd68bd86626f42460b625c85cdf1c29d002e4fa0ba

Download | Favorite | View

Hashicorp Vault AWS IAM Integration Authentication Bypass

Posted Oct 6, 2020

Authored by Google Security Research, Felix Wilhelm

HashiCorp Vault's AWS IAM authentication method can be bypassed by sending a serialized request to the STS AssumeRoleWithWebIdentity method as part of the authentication flow. The request triggers a JSON encoded response from the STS server, which can contain a fully-attacker controlled fake GetCallerIdentityResponse as part of its body. As the Vault response parser ignores non-xml content before and after the malicious response, this can be used to spoof arbitrary AWS identities and roles.

tags | exploit, arbitrary, spoof

advisories | CVE-2020-16250

SHA-256 | b13c4db73c9c1c434d36ca980312a9413268770cfb76417ed250b35bd357b407

Download | Favorite | View