GHSA-vhfq-9q32-q69f: Missing integrity verification for openshift-ansible scripts
The openshift-ansible installer container's run script downloads and executes remote inventory and dynamic scripts without integrity verification. A man-in-the-middle attacker or an attacker who compromises the HTTP server providing the scripts could replace a script with an arbitrary executable, which would run with the installer's user ID and full cluster-provisioning privileges.
CERT24