Threats tagged 'ghsa-mvpf-rh77-cjfw'

Eclipse ioFog Operator versions 3.8.0 up to but not including 3.9.2 disable TLS certificate verification when contacting the Controller API and logging into an external OIDC issuer. This allows an on-path attacker to present any certificate and capture sensitive credentials such as the OAuth client secret or the Controller bootstrap admin password. These credentials can then be used to supply access tokens for subsequent Controller API calls.