Skip to content
Fencer Vulns
high 7.5

CVE-2024-5037 json

Openshift/telemeter: iss check during jwt authentication can be bypassed

published 2024-06-05 2 y ago modified 2026-06-17 4 mo ago also GO-2024-2905 , EUVD-2024-47148

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON web token (JWT) authentication.

Patch / fix

  • Red Hat Red Hat OpenShift Container Platform 4.12 v4.12.0-202408071159.p0.gc9592de.assembly.stream.el8
  • Red Hat Red Hat OpenShift Container Platform 4.13 v4.13.0-202407081338.p0.g0634a6d.assembly.stream.el8
  • Red Hat Red Hat OpenShift Container Platform 4.14 v4.14.0-202407021509.p0.g1f72681.assembly.stream.el8
  • Red Hat Red Hat OpenShift Container Platform 4.15 v4.15.0-202406200537.p0.g14489f7.assembly.stream.el9
  • Red Hat Red Hat OpenShift Container Platform 4.16 v4.16.0-202406200537.p0.gc1ecd10.assembly.stream.el9

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-5037 updated cvss 7.5

openshift/telemeter: iss check during JWT authentication can be bypassed

  • Red Hat OpenShift distributed tracing 2 rhosdt/tempo-gateway-opa-rhel8 Red Hat OpenShift distributed tracing 3 rhosdt/tempo-gateway-opa-rhel8
    affected: no fix available
  • Red Hat OpenShift Container Platform 4.12 openshift4/ose-telemeter v4.12.0-202408071159.p0.gc9592de.assembly.stream.el8
    fixed: vendor fix RHSA-2024:5200
  • Red Hat OpenShift Container Platform 4.13 openshift4/ose-telemeter v4.13.0-202407081338.p0.g0634a6d.assembly.stream.el8
    fixed: vendor fix RHSA-2024:4484
  • Red Hat OpenShift Container Platform 4.14 openshift4/ose-telemeter v4.14.0-202407021509.p0.g1f72681.assembly.stream.el8
    fixed: vendor fix RHSA-2024:4329
  • Red Hat OpenShift Container Platform 4.15 openshift4/ose-telemeter-rhel9 v4.15.0-202406200537.p0.g14489f7.assembly.stream.el9
    fixed: vendor fix RHSA-2024:4151
  • Red Hat OpenShift Container Platform 4.16 openshift4/ose-telemeter-rhel9 v4.16.0-202406200537.p0.gc1ecd10.assembly.stream.el9
    fixed: vendor fix RHSA-2024:4156
  • Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/opa-openshift-rhel8 Red Hat OpenShift Container Platform 4.12 rhcos 412.86.202408091913-0, openshift4/ose-cli v4.12.0-202408071159.p0.gd691257.assembly.stream.el8, openshift4/ose-pod v4.12.0-202408071159.p0.g306a47e.assembly.stream.el8, openshift4/ose-etcd v4.12.0-202408071159.p0.gbb82e89.assembly.stream.el8, openshift4/ose-tests v4.12.0-202408091932.p0.g7b7d4ef.assembly.stream.el8, openshift4/ose-console v4.12.0-202408091932.p0.g4dd47ed.assembly.stream.el8, +185 more Red Hat OpenShift Container Platform 4.13 rhcos 413.92.202407091321-0, openshift4/ose-cli v4.13.0-202407081338.p0.gd192e90.assembly.stream.el8, openshift4/ose-pod v4.13.0-202407081338.p0.g4818370.assembly.stream.el8, openshift4/ose-tests v4.13.0-202407081338.p0.g36ca5dc.assembly.stream.el8, openshift4/ose-console v4.13.0-202407081338.p0.gdc7be0c.assembly.stream.el8, openshift4/ose-coredns v4.13.0-202407081338.p0.g298d919.assembly.stream.el8, +186 more Red Hat OpenShift Container Platform 4.14 rhcos 414.92.202407032149-0, openshift4/ose-cli v4.14.0-202407021509.p0.gaa6e2f2.assembly.stream.el8, openshift4/ose-pod v4.14.0-202407032040.p0.g6147456.assembly.stream.el8, openshift4/ose-tests v4.14.0-202407030810.p0.gc0dd3a0.assembly.stream.el8, openshift4/ose-console v4.14.0-202407040439.p0.g64b4374.assembly.stream.el8, openshift4/ose-coredns v4.14.0-202407021509.p0.g7d3fa77.assembly.stream.el8, +193 more Red Hat OpenShift Container Platform 4.15 rhcos 415.92.202406251950-0, openshift4/ose-cli v4.15.0-202406211306.p0.g44edfb5.assembly.stream.el8, openshift4/ose-tests v4.15.0-202406250937.p0.gc13a01e.assembly.stream.el8, openshift4/ose-console v4.15.0-202406260237.p0.g823ec89.assembly.stream.el8, openshift4/ose-deployer v4.15.0-202406211306.p0.g44edfb5.assembly.stream.el8, openshift4/ose-installer v4.15.0-202406251908.p0.g132530d.assembly.stream.el8, +188 more Red Hat OpenShift Container Platform 4.16 rhcos 416.94.202406251923-0, openshift4/ose-cli-rhel9 v4.16.0-202406200537.p0.ga245041.assembly.stream.el9, openshift4/ose-pod-rhel9 v4.16.0-202406200537.p0.g58452d8.assembly.stream.el9, openshift4/ose-sdn-rhel9 v4.16.0-202406200537.p0.g5b658c4.assembly.stream.el9, openshift4/ose-etcd-rhel9 v4.16.0-202406200537.p0.gbc2fec2.assembly.stream.el9, openshift4/ose-tests-rhel9 v4.16.0-202406260037.p0.gf546249.assembly.stream.el9, +182 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
go github.com/openshift/telemeter
all versions
 no fix listed

Affected products

  • Red Hat Red Hat OpenShift Container Platform 4.12
  • Red Hat Red Hat OpenShift Container Platform 4.13
  • Red Hat Red Hat OpenShift Container Platform 4.14
  • Red Hat Red Hat OpenShift Container Platform 4.15
  • Red Hat Red Hat OpenShift Container Platform 4.16
  • Red Hat Logging Subsystem for Red Hat OpenShift
  • Red Hat Red Hat OpenShift distributed tracing 2
  • Red Hat Red Hat OpenShift distributed tracing 3

Classification

Weakness
  • CWE-290 Authentication Bypass by Spoofing

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.