S3 credentials included when exporting elyra notebook

CVE-2023-3361

Summary

A vulnerability exists in Red Hat OpenShift Data Science that compromises the security of S3 credentials during the export of pipelines from the Elyra notebook pipeline editor. When exporting as Python DSL or YAML, the system erroneously saves sensitive S3 credentials in plain text within the generated output. This occurs instead of using an identifier for a stored Kubernetes secret, leading to potential unauthorized access to sensitive data.

References