Page 4 of 20 results (0.018 seconds)

CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0

CVE-2017-15138

https://notcve.org/view.php?id=CVE-2017-15138

The OpenShift Enterprise cluster-read can access webhook tokens which would allow an attacker with sufficient privileges to view confidential webhook tokens. La lectura en clúster de OpenShift Enterprise puede acceder a tokens webhook que permitirían a un atacante con privilegios suficientes ver tokens webhook confidenciales. • https://access.redhat.com/errata/RHBA-2018:0489 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15138 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •

CVSS: 5.3EPSS: 0%CPEs: 2EXPL: 0

CVE-2017-15137

https://notcve.org/view.php?id=CVE-2017-15137

The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed. La lista blanca de importación de imágenes de OpenShift falló a la hora de aplicar restricciones correctamente al ejecutar comandos como, por ejemplo, "oc tag". Esto podría permitir que un usuario con acceso a OpenShift ejecute imágenes de registros en los que no debería estarle permitido. • https://access.redhat.com/errata/RHBA-2018:0489 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15137 • CWE-20: Improper Input Validation •

CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0

CVE-2018-10843 – source-to-image: Builder images with assembler-user LABEL set to root allows attackers to execute arbitrary code

https://notcve.org/view.php?id=CVE-2018-10843

source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalation which allows the assemble script to run as the root user in a non-privileged container. An attacker can use this flaw to open network connections, and possibly other actions, on the host which are normally only available to a root user. El componente source-to-image de Openshift Container Platform en versiones anteriores a atomic-openshift 3.7.53 y atomic-openshift 3.9.31 es vulnerable a un escalado de privilegios que permite que el script assemble se ejecute como usuario root en un contenedor no privilegiado. Un atacante puede usar este fallo para abrir conexiones de red y posiblemente otras acciones en el host que normalmente está disponible solo para un usuario root. A privilege escalation flaw was found in the source-to-image component of Openshift Container Platform which allows the assemble script to run as the root user in a non-privileged container. • https://access.redhat.com/errata/RHSA-2018:2013 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10843 https://access.redhat.com/security/cve/CVE-2018-10843 https://bugzilla.redhat.com/show_bug.cgi?id=1579096 • CWE-20: Improper Input Validation CWE-732: Incorrect Permission Assignment for Critical Resource •

CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-1085 – openshift-ansible: Incorrectly quoted values in etcd.conf causes disabling of SSL client certificate authentication

https://notcve.org/view.php?id=CVE-2018-1085

openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCD_CLIENT_CERT_AUTH and ETCD_PEER_CLIENT_CERT_AUTH in etcd.conf result in etcd being configured to allow remote users to connect without any authentication if they can access the etcd server bound to the network on the master nodes. An attacker could use this flaw to read and modify all the data about the Openshift cluster in the etcd datastore, potentially adding another compute node, or bringing down the entire cluster. openshift-ansible en versiones anteriores a la 3.9.23 y 3.7.46 implementa un archivo etcd mal configurado que provoca que la autenticación del certificado de cliente SSL se deshabilite. Las comillas en los valores de ETCD_CLIENT_CERT_AUTH y ETCD_PEER_CLIENT_CERT_AUTH en etcd.conf resultan en que etcd se configura para permitir que usuarios remotos se conecten sin autenticación si pueden acceder al servidor etcd enlazado a la red en los nodos maestros. Un atacante puede emplear este error para leer y modificar todos los datos sobre el clúster Openshift en el almacén de datos etcd, añadiendo potencialmente otro nodo de ordenador o haciendo que caiga todo el clúster. • https://access.redhat.com/errata/RHSA-2018:2013 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1085 https://access.redhat.com/security/cve/CVE-2018-1085 https://bugzilla.redhat.com/show_bug.cgi?id=1557822 • CWE-287: Improper Authentication CWE-592: DEPRECATED: Authentication Bypass Issues •

CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0

CVE-2018-1070 – Routing: Malicous Service configuration can bring down routing for an entire shard.

https://notcve.org/view.php?id=CVE-2018-1070

routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which can cause an entire shard to be brought down. A malicious user can use this vulnerability to cause a Denial of Service attack for other users of the router shard. routing en versiones anteriores a la 3.10 es vulnerable a una validación de entradas incorrecta de la configuración de Openshift Routing que puede permitir que una partición entera se caiga. Un usuario malicioso puede emplear esta vulnerabilidad para provocar un ataque de denegación de servicio (DoS) para otros usuarios de la partición del router. Improper input validation of the Openshift Routing configuration can cause an entire shard to be brought down. A malicious user can use this vulnerability to cause a Denial of Service attack for other users of the router shard. • https://access.redhat.com/errata/RHSA-2018:2013 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1070 https://access.redhat.com/security/cve/CVE-2018-1070 https://bugzilla.redhat.com/show_bug.cgi?id=1553035 • CWE-20: Improper Input Validation •