CVE-2024-6508: Red Hat Openshift Container Platform 4.12

High severity, CVSS 8.0. EPSS: 0.7% chance of exploitation in the next 30 days.

An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This flaw allows logging into the victim’s current application account using a third-party account without any restrictions.

Affected products

• Red Hat Red Hat Openshift Container Platform 4.12: before v4.12.0-202412201659.p0.g8910d84.assembly.stream.el8 (fixed in v4.12.0-202412201659.p0.g8910d84.assembly.stream.el8)
• Red Hat Red Hat Openshift Container Platform 4.13: before v4.13.0-202411300029.p0.g68accd9.assembly.stream.el8 (fixed in v4.13.0-202411300029.p0.g68accd9.assembly.stream.el8)
• Red Hat Red Hat Openshift Container Platform 4.14: before v4.14.0-202411131205.p0.g839a801.assembly.stream.el8 (fixed in v4.14.0-202411131205.p0.g839a801.assembly.stream.el8)
• Red Hat Red Hat Openshift Container Platform 4.15: before v4.15.0-202411060036.p0.gd8360d4.assembly.stream.el8 (fixed in v4.15.0-202411060036.p0.gd8360d4.assembly.stream.el8)
• Red Hat Red Hat Openshift Container Platform 4.16: before v4.16.0-202410231737.p0.gf0870c3.assembly.stream.el9 (fixed in v4.16.0-202410231737.p0.gf0870c3.assembly.stream.el9)
• Red Hat Red Hat Openshift Container Platform 4.17: before v4.17.0-202410091535.p0.ge61f187.assembly.stream.el9 (fixed in v4.17.0-202410091535.p0.ge61f187.assembly.stream.el9)
• Red Hat Red Hat Openshift Container Platform 4.18: before v4.18.0-202501230001.p0.g088dcaf.assembly.stream.el9 (fixed in v4.18.0-202501230001.p0.g088dcaf.assembly.stream.el9); before v4.18.0-202501230001.p0.gd4fb1b6.assembly.stream.el9 (fixed in v4.18.0-202501230001.p0.gd4fb1b6.assembly.stream.el9); before v4.18.0-202501230001.p0.g11ced00.assembly.stream.el9 (fixed in v4.18.0-202501230001.p0.g11ced00.assembly.stream.el9); before v4.18.0-202501230001.p0.gf648c78.assembly.stream.el9 (fixed in v4.18.0-202501230001.p0.gf648c78.assembly.stream.el9); before v4.18.0-202501230001.p0.g24a6532.assembly.stream.el9 (fixed in v4.18.0-202501230001.p0.g24a6532.assembly.stream.el9); before v4.18.0-202502100301.p0.g2e139ed.assembly.stream.el9 (fixed in v4.18.0-202502100301.p0.g2e139ed.assembly.stream.el9); …

Published 2024-08-21. Last modified 2026-08-11.