Withdrawn Advisory: OpenShift OAuth Server XSS Vulnerability

中 6.3CVE-2019-3876 · GHSA-jgwg-35hf-xqrr · 01/04/2019 公開 · 17/06/2026 更新

要点

CVE-2019-3876 は github.com/openshift/oauth-apiserver, openshift container platform (redhat) に影響する深刻度「中」 (CVSS 6.3) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.67%（全脆弱性の 52.1% より高い）。
対処：3.11 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
github.com/openshift/oauth-apiserver Go	`≥ 3.0, < 3.11`	`3.11`
openshift container platform redhat	`≥ 3.0, ≤ 3.11`	修正版なし

概要

Withdrawn Advisory

This advisory has been withdrawn because the vulnerability does not affect a package in one of the GitHub Advisory Database's supported ecosystems. This link is maintained to preserve external references.

Original Description

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.

NVD の説明

A flaw was found in the /oauth/token/request custom endpoint of the OpenShift OAuth server allowing for XSS generation of CLI tokens due to missing X-Frame-Options and CSRF protections. If not otherwise prevented, a separate XSS vulnerability via JavaScript could further allow for the extraction of these tokens.