This vulnerability affects the skupper console component used in hybrid multi-cloud environments. When using the default authentication method, a random admin password is stored insecurely in plaintext within Kubernetes secrets or podman volumes. This weakness allows an attacker with some privileges to bypass authentication controls and read arbitrary user-readable files inside the container filesystem, impacting data confidentiality. Furthermore, the attacker can induce the system to read excessively large files into memory, causing resource exhaustion and denial of service. The issue is tracked as CVE-2024-12582 with a CVSS 3.1 score of 7.1, indicating a high severity. Red Hat has issued updated container images for Service Interconnect 1.8 on RHEL 9 that contain backported patches to fix this vulnerability. Users should upgrade to these images and rebuild dependent containers as recommended by Red Hat.

Exploitation of this vulnerability allows an attacker to read any user-readable file within the container filesystem, compromising data confidentiality. Additionally, the attacker can cause resource exhaustion by forcing the system to load very large files into memory, resulting in denial of service. The vulnerability does not directly impact integrity but has a high impact on availability and a low impact on confidentiality according to the CVSS vector. There are no known exploits in the wild at this time.

Red Hat has released updated Service Interconnect 1.8 container images for RHEL 9 that include patches addressing CVE-2024-12582. Users should upgrade to these updated images and rebuild all container images that depend on them. Before applying this update, ensure all previously released errata relevant to your system have been applied. Follow Red Hat's official guidance for applying these updates as detailed in their advisory. Patch status is confirmed as an official fix available from Red Hat.