High [CVE-2024-1139] Cluster-monitoring-operator: credentials leak
This high-severity Red Hat Linux advisory covers CVE-2024-1139 affecting Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A credentials leak vulnerability was found in the cluster monitoring operator in OCP. This issue may allow a remote attacker who has basic login credentials to check the pod manifest to discover a repository pull secret.
Red Hat severity: Important — CVSS 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Weakness: CWE-200.
Affected Red Hat products: Red Hat OpenShift Container Platform 4.12; Red Hat OpenShift Container Platform 4.13; Red Hat OpenShift Container Platform 4.14; Red Hat OpenShift Container Platform 4.15; Red Hat OpenShift Container Platform 3.11. Red Hat lists Red Hat Advanced Cluster Management for Kubernetes 2 as not affected.
Will not fix / out of support: Red Hat OpenShift Container Platform 3.11. Red Hat fixing advisory: RHSA-2024:2782, RHSA-2024:2047, RHSA-2024:1891, RHSA-2024:1887.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
- openshift4/ose-cluster-monitoring-operator:v4.12.0-202405091536.p0.g8906207.assembly.stream.el8
- openshift4/ose-cluster-monitoring-operator:v4.13.0-202404200313.p0.gb518881.assembly.stream.el8
- openshift4/cloud-network-config-controller-rhel8:v4.14.0-202404161544.p0.gf350a68.assembly.stream.el8
- openshift4/driver-toolkit-rhel9:v4.14.0-202404161544.p0.gcafed17.assembly.stream.el9
- openshift4/egress-router-cni-rhel8:v4.14.0-202404161544.p0.gafffdd4.assembly.stream.el8
- openshift4/kubevirt-csi-driver-rhel8:v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8
- openshift4/network-tools-rhel8:v4.14.0-202404161544.p0.ge79d817.assembly.stream.el8
- openshift4/oc-mirror-plugin-rhel8:v4.14.0-202404161544.p0.ga0733c1.assembly.stream.el8
- openshift4/openshift-route-controller-manager-rhel8:v4.14.0-202404161544.p0.g1a5e72f.assembly.stream.el8
- openshift4/ose-agent-installer-api-server-rhel8:v4.14.0-202404161544.p0.g2dbe78f.assembly.stream.el8
- openshift4/ose-agent-installer-csr-approver-rhel8:v4.14.0-202404161544.p0.g46dedc6.assembly.stream.el8
- openshift4/ose-agent-installer-node-agent-rhel9:v4.14.0-202404161544.p0.gd8cf3c9.assembly.stream.el9
- openshift4/ose-agent-installer-orchestrator-rhel8:v4.14.0-202404161544.p0.g46dedc6.assembly.stream.el8
- openshift4/ose-agent-installer-utils-rhel9:v4.14.0-202404161544.p0.gad85376.assembly.stream.el9
- openshift4/ose-alibaba-cloud-controller-manager-rhel8:v4.14.0-202404161544.p0.g8ba0b37.assembly.stream.el8
- openshift4/ose-alibaba-cloud-csi-driver-container-rhel8:v4.14.0-202404170009.p0.g3dc363d.assembly.stream.el8
- openshift4/ose-alibaba-disk-csi-driver-operator-container-rhel8:v4.14.0-202404161544.p0.g8853e6e.assembly.stream.el8
- openshift4/ose-alibaba-machine-controllers-rhel8:v4.14.0-202404161544.p0.g27f105d.assembly.stream.el8
- openshift4/ose-apiserver-network-proxy-rhel8:v4.14.0-202404161544.p0.g3362d67.assembly.stream.el8
- openshift4/ose-aws-cloud-controller-manager-rhel8:v4.14.0-202404161544.p0.g607e2dd.assembly.stream.el8
- openshift4/ose-aws-cluster-api-controllers-rhel8:v4.14.0-202404161544.p0.g54a95bd.assembly.stream.el8
- openshift4/ose-aws-ebs-csi-driver-rhel8:v4.14.0-202404161544.p0.g2e2e277.assembly.stream.el8
- openshift4/ose-aws-ebs-csi-driver-rhel8-operator:v4.14.0-202404161544.p0.g95bcf9a.assembly.stream.el8
- openshift4/ose-aws-pod-identity-webhook-rhel8:v4.14.0-202404161544.p0.gad7aa0a.assembly.stream.el8
- openshift4/ose-azure-cloud-controller-manager-rhel8:v4.14.0-202404161544.p0.gf0e7cbb.assembly.stream.el8
- openshift4/ose-azure-cloud-node-manager-rhel8:v4.14.0-202404161544.p0.gf0e7cbb.assembly.stream.el8
- openshift4/ose-azure-cluster-api-controllers-rhel8:v4.14.0-202404161544.p0.g7ad2773.assembly.stream.el8
- openshift4/ose-azure-disk-csi-driver-rhel8:v4.14.0-202404161544.p0.gb19eec1.assembly.stream.el8
- openshift4/ose-azure-disk-csi-driver-rhel8-operator:v4.14.0-202404161544.p0.g9189357.assembly.stream.el8
- openshift4/ose-azure-file-csi-driver-operator-rhel8:v4.14.0-202404161544.p0.g354c55d.assembly.stream.el8
- openshift4/ose-azure-file-csi-driver-rhel8:v4.14.0-202404161544.p0.gf401f53.assembly.stream.el8
- openshift4/ose-azure-workload-identity-webhook-rhel8:v4.14.0-202404161544.p0.g43a15be.assembly.stream.el8
- openshift4/ose-baremetal-installer-rhel8:v4.14.0-202404161544.p0.g78da43a.assembly.stream.el8
- openshift4/ose-baremetal-machine-controllers:v4.14.0-202404161544.p0.gfb20cda.assembly.stream.el8
- openshift4/ose-baremetal-rhel8-operator:v4.14.0-202404161544.p0.g937b5fd.assembly.stream.el8
- openshift4/ose-baremetal-runtimecfg-rhel8:v4.14.0-202404161544.p0.g13046b3.assembly.stream.el8
- openshift4/ose-cli:v4.14.0-202404161544.p0.gf7b14a9.assembly.stream.el8
- openshift4/ose-cli-artifacts:v4.14.0-202404161544.p0.gf7b14a9.assembly.stream.el8
- openshift4/ose-cloud-credential-operator:v4.14.0-202404161544.p0.ga687275.assembly.stream.el8
- openshift4/ose-cluster-api-rhel8:v4.14.0-202404161544.p0.gae83c55.assembly.stream.el8
- RHSA-2024:2782
- RHSA-2024:2047
- RHSA-2024:1891
- RHSA-2024:1887
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation
Upgrade to a fixed release: openshift4/ose-cluster-monitoring-operator:v4.12.0-202405091536.p0.g8906207.assembly.stream.el8, openshift4/ose-cluster-monitoring-operator:v4.13.0-202404200313.p0.gb518881.assembly.stream.el8, openshift4/cloud-network-config-controller-rhel8:v4.14.0-202404161544.p0.gf350a68.assembly.stream.el8, openshift4/driver-toolkit-rhel9:v4.14.0-202404161544.p0.gcafed17.assembly.stream.el9, openshift4/egress-router-cni-rhel8:v4.14.0-202404161544.p0.gafffdd4.assembly.stream.el8, openshift4/kubevirt-csi-driver-rhel8:v4.14.0-202404161544.p0.g48fafc4.assembly.stream.el8. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.