medium6.5
CVE-2022-1632
An Improper Certificate Validation attack was found in Openshift.
Impact
An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the default serviceCA skips internal Service TLS certificate validation. This flaw allows an attacker to exploit an invalid certificate, resulting in a loss of confidentiality.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Ansible Automation Platform | Version 2.0 |
| Redhat | Openshift Container Platform | Version 4.0 |
| Fedoraproject | Fedora | Versions 34, 35 |