Product:

Openshift

(Redhat)
Repositories • https://github.com/openshift/origin-server
• https://github.com/opencontainers/runc
• https://github.com/jenkinsci/jenkins
• https://github.com/libarchive/libarchive
• https://github.com/php/php-src
#Vulnerabilities 139
Date Id Summary Products Score Patch Annotated
2016-06-08 CVE-2016-3738 Red Hat OpenShift Enterprise 3.2 does not properly restrict access to STI builds, which allows remote authenticated users to access the Docker socket and gain privileges via vectors related to build-pod. Openshift 8.8
2016-08-05 CVE-2016-5392 The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive project and user information via vectors related to the watch-cache list. Openshift 6.5
2018-04-30 CVE-2018-1102 A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation. Openshift 8.8
2018-07-16 CVE-2017-15137 The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed. Openshift, Openshift_container_platform 5.3
2018-07-31 CVE-2016-8631 The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site. Openshift 7.7
2018-08-01 CVE-2016-8651 An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image. Openshift, Openshift_container_platform 3.5
2018-09-10 CVE-2016-7075 It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate. Kubernetes, Openshift 8.1
2019-10-08 CVE-2019-14845 A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3. Builds that extract source from a container image, bypass the TLS hostname verification. An attacker can take advantage of this flaw by launching a man-in-the-middle attack and injecting malicious content. Openshift 5.3
2019-11-01 CVE-2013-0165 cartridges/openshift-origin-cartridge-mongodb-2.2/info/bin/dump.sh in OpenShift does not properly create files in /tmp. Openshift 7.3
2019-12-13 CVE-2014-0175 mcollective has a default password set at install Debian_linux, Marionette_collective, Openshift 9.8