An insufficient entropy vulnerability (CVE-2024-6508) was identified in the OpenShift Console's implementation of OAuth2, specifically in the authorization code and implicit grant types. The OAuth2 protocol relies on the state parameter to prevent CSRF attacks, but when this parameter is generated with insufficient randomness, it can be exploited to bypass authentication restrictions. This allows an attacker to log into the victim's current application account using a third-party account without proper authorization. The vulnerability affects OpenShift Container Platform versions >=4.13.0 <4.13.54 and >=4.17.0 <4.17.1. Red Hat has issued security advisories RHSA-2024:10813 and RHSA-2024:7922, providing updated container images and packages that fix this flaw. Users are advised to upgrade to OpenShift Container Platform 4.13.54 or 4.17.1 or later to mitigate this vulnerability.

Successful exploitation of this vulnerability could allow an attacker to perform a CSRF attack against the OAuth2 authorization flow, enabling unauthorized login to a victim's application account via a third-party account. This compromises confidentiality, integrity, and availability of the affected system as indicated by the CVSS vector (C:High, I:High, A:High). The vulnerability affects on-premise or private cloud deployments of OpenShift Container Platform versions specified. No known exploits in the wild have been reported at this time.

Red Hat has released official security updates addressing CVE-2024-6508 in OpenShift Container Platform versions 4.13.54 and 4.17.1. Users should upgrade their OpenShift clusters to these versions or later as soon as possible using the OpenShift CLI (oc) or web console. The vendor manages remediation for these on-premise deployments via these updates. No additional mitigation steps are indicated beyond applying the official patches.