[{"uuid":"GSA_kwCzR0hTQS1ycXBoLTI1cTktOWpocM4AAtJk","url":"https://github.com/advisories/GHSA-rqph-25q9-9jhp","title":"Insecure cookies in Openshift Origin","description":"In Openshift Origin the cookies being set in console have no 'secure', 'HttpOnly' attributes.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-07-08T00:00:48.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2015-3207","https://github.com/openshift/origin/pull/2261","https://github.com/openshift/origin/pull/2291","https://bugzilla.redhat.com/show_bug.cgi?id=1221882","https://github.com/advisories/GHSA-rqph-25q9-9jhp"],"source_kind":"github","identifiers":["GHSA-rqph-25q9-9jhp","CVE-2015-3207"],"repository_url":"https://github.com/openshift/origin","blast_radius":0.0,"created_at":"2022-12-21T16:12:11.686Z","updated_at":"2026-10-17T05:30:11.334Z","epss_percentage":0.00739,"epss_percentile":0.53555,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ycXBoLTI1cTktOWpocM4AAtJk","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1ycXBoLTI1cTktOWpocM4AAtJk","packages":[{"ecosystem":"go","package_name":"github.com/openshift/origin","versions":[{"first_patched_version":"1.0.0","vulnerable_version_range":"\u003c 1.0.0"}],"purl":"pkg:go/github.com%2Fopenshift%2Forigin","statistics":{"dependent_packages_count":30,"dependent_repos_count":983,"downloads":null,"downloads_period":null},"affected_versions":[],"unaffected_versions":["v1.0.0","v1.0.1","v1.0.2","v1.0.3","v1.0.4","v1.0.5","v1.0.6","v1.0.7","v1.0.8","v1.1.1","v1.1.2","v1.1.3","v1.1.4","v1.1.5","v1.1.6","v1.2.0","v1.2.1","v1.2.2","v1.3.0","v1.3.1","v1.3.2","v1.3.3","v1.4.0","v1.4.1","v1.5.0","v1.5.1","v1.5.2","v1.6.0","v3.6.0+incompatible","v3.6.1+incompatible","v3.7.0+incompatible","v3.7.1+incompatible","v3.7.2+incompatible","v3.8.0+incompatible","v3.9.0+incompatible","v3.10.0+incompatible","v3.11.0+incompatible","v4.1.0+incompatible"]}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ycXBoLTI1cTktOWpocM4AAtJk/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJmM20tbWh2Ny14Mzlm","url":"https://github.com/advisories/GHSA-rf3m-mhv7-x39f","title":"Denial of Service in OpenShift Origin","description":"The API server in OpenShift Origin 1.0.5 allows remote attackers to cause a denial of service (master process crash) via crafted JSON data","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-12-20T16:58:22.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":4.3,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","references":["https://nvd.nist.gov/vuln/detail/CVE-2015-5250","https://github.com/openshift/origin/issues/4374","https://github.com/openshift/origin/commit/dace5075e31b74703e944b6b3ebe8836be8d1b9a","https://access.redhat.com/errata/RHSA-2015:1736","https://bugzilla.redhat.com/show_bug.cgi?id=1259867","https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5250","https://access.redhat.com/security/cve/CVE-2015-5250","https://github.com/advisories/GHSA-rf3m-mhv7-x39f"],"source_kind":"github","identifiers":["GHSA-rf3m-mhv7-x39f","CVE-2015-5250"],"repository_url":"https://github.com/openshift/origin","blast_radius":0.0,"created_at":"2022-12-21T16:13:01.937Z","updated_at":"2026-10-03T14:15:24.449Z","epss_percentage":0.01989,"epss_percentile":0.79863,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJmM20tbWh2Ny14Mzlm","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJmM20tbWh2Ny14Mzlm","packages":[{"ecosystem":"go","package_name":"github.com/openshift/origin","versions":[{"first_patched_version":"1.0.6","vulnerable_version_range":"\u003c 1.0.6"}],"purl":"pkg:go/github.com%2Fopenshift%2Forigin"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJmM20tbWh2Ny14Mzlm/related_packages","related_advisories":[]},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW0zZm0taDVqcC1xNzlw","url":"https://github.com/advisories/GHSA-m3fm-h5jp-q79p","title":"Authorization bypass in Openshift","description":"Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.","origin":"UNSPECIFIED","severity":"CRITICAL","published_at":"2021-12-20T16:58:14.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":9.8,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":["https://nvd.nist.gov/vuln/detail/CVE-2016-1906","https://github.com/openshift/origin/issues/6556","https://github.com/openshift/origin/pull/6576","https://github.com/openshift/origin/commit/d95ec085f03ecf10e8c424a4f0340ddb38891406","https://access.redhat.com/errata/RHSA-2016:0070","https://access.redhat.com/errata/RHSA-2016:0351","https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-1906","https://access.redhat.com/security/cve/CVE-2016-1906","https://bugzilla.redhat.com/show_bug.cgi?id=1297916","https://github.com/advisories/GHSA-m3fm-h5jp-q79p"],"source_kind":"github","identifiers":["GHSA-m3fm-h5jp-q79p","CVE-2016-1906"],"repository_url":"https://github.com/openshift/origin","blast_radius":0.0,"created_at":"2022-12-21T16:13:01.981Z","updated_at":"2026-09-30T09:18:31.190Z","epss_percentage":0.04843,"epss_percentile":0.91606,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW0zZm0taDVqcC1xNzlw","html_url":"https://advisories.ecosyste.ms/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW0zZm0taDVqcC1xNzlw","packages":[{"ecosystem":"go","package_name":"github.com/openshift/origin","versions":[{"first_patched_version":"1.1.1","vulnerable_version_range":"\u003c 1.1.1"}],"purl":"pkg:go/github.com%2Fopenshift%2Forigin"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLW0zZm0taDVqcC1xNzlw/related_packages","related_advisories":[]}]