CVE Vulnerabilities

CVE-2020-25688

Use of Hard-coded Cryptographic Key

Published: Nov 23, 2020 | Modified: Nov 21, 2024
CVSS 3.x
3.5
LOW
Source:
NVD
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.x
2.7 LOW
AV:A/AC:L/Au:S/C:P/I:N/A:N
RedHat/V2
RedHat/V3
3.5 LOW
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Ubuntu

A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a cluster, they could use the private key to decode API requests that should be protected by TLS sessions, potentially obtaining information they would not otherwise be able to. These certificates are not used for service authentication, so no opportunity for impersonation or active MITM attacks were made possible.

Weakness

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

Affected Software

Name Vendor Start Version End Version
Advanced_cluster_management_for_kubernetes Redhat * 2.0.5 (excluding)
Red Hat Advanced Cluster Management for Kubernetes 2.0 for RHEL 8 RedHat rhacm2/acm-operator-bundle:v2.0.5-5 *
Red Hat Advanced Cluster Management for Kubernetes 2.1 for RHEL 8 RedHat rhacm2/acm-must-gather-rhel8:v2.1.0-11 *

Potential Mitigations

References