CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2018-10843 – source-to-image: Builder images with assembler-user LABEL set to root allows attackers to execute arbitrary code
https://notcve.org/view.php?id=CVE-2018-10843
source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalation which allows the assemble script to run as the root user in a non-privileged container. An attacker can use this flaw to open network connections, and possibly other actions, on the host which are normally only available to a root user. El componente source-to-image de Openshift Container Platform en versiones anteriores a atomic-openshift 3.7.53 y atomic-openshift 3.9.31 es vulnerable a un escalado de privilegios que permite que el script assemble se ejecute como usuario root en un contenedor no privilegiado. Un atacante puede usar este fallo para abrir conexiones de red y posiblemente otras acciones en el host que normalmente está disponible solo para un usuario root. A privilege escalation flaw was found in the source-to-image component of Openshift Container Platform which allows the assemble script to run as the root user in a non-privileged container. • https://access.redhat.com/errata/RHSA-2018:2013 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10843 https://access.redhat.com/security/cve/CVE-2018-10843 https://bugzilla.redhat.com/show_bug.cgi?id=1579096 • CWE-20: Improper Input Validation CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1085 – openshift-ansible: Incorrectly quoted values in etcd.conf causes disabling of SSL client certificate authentication
https://notcve.org/view.php?id=CVE-2018-1085
openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCD_CLIENT_CERT_AUTH and ETCD_PEER_CLIENT_CERT_AUTH in etcd.conf result in etcd being configured to allow remote users to connect without any authentication if they can access the etcd server bound to the network on the master nodes. An attacker could use this flaw to read and modify all the data about the Openshift cluster in the etcd datastore, potentially adding another compute node, or bringing down the entire cluster. openshift-ansible en versiones anteriores a la 3.9.23 y 3.7.46 implementa un archivo etcd mal configurado que provoca que la autenticación del certificado de cliente SSL se deshabilite. Las comillas en los valores de ETCD_CLIENT_CERT_AUTH y ETCD_PEER_CLIENT_CERT_AUTH en etcd.conf resultan en que etcd se configura para permitir que usuarios remotos se conecten sin autenticación si pueden acceder al servidor etcd enlazado a la red en los nodos maestros. Un atacante puede emplear este error para leer y modificar todos los datos sobre el clúster Openshift en el almacén de datos etcd, añadiendo potencialmente otro nodo de ordenador o haciendo que caiga todo el clúster. • https://access.redhat.com/errata/RHSA-2018:2013 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1085 https://access.redhat.com/security/cve/CVE-2018-1085 https://bugzilla.redhat.com/show_bug.cgi?id=1557822 • CWE-287: Improper Authentication CWE-592: DEPRECATED: Authentication Bypass Issues •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-1070 – Routing: Malicous Service configuration can bring down routing for an entire shard.
https://notcve.org/view.php?id=CVE-2018-1070
routing before version 3.10 is vulnerable to an improper input validation of the Openshift Routing configuration which can cause an entire shard to be brought down. A malicious user can use this vulnerability to cause a Denial of Service attack for other users of the router shard. routing en versiones anteriores a la 3.10 es vulnerable a una validación de entradas incorrecta de la configuración de Openshift Routing que puede permitir que una partición entera se caiga. Un usuario malicioso puede emplear esta vulnerabilidad para provocar un ataque de denegación de servicio (DoS) para otros usuarios de la partición del router. Improper input validation of the Openshift Routing configuration can cause an entire shard to be brought down. A malicious user can use this vulnerability to cause a Denial of Service attack for other users of the router shard. • https://access.redhat.com/errata/RHSA-2018:2013 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1070 https://access.redhat.com/security/cve/CVE-2018-1070 https://bugzilla.redhat.com/show_bug.cgi?id=1553035 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 71EXPL: 0CVE-2018-1257 – spring-framework: ReDoS Attack with spring-messaging
https://notcve.org/view.php?id=CVE-2018-1257
Spring Framework, versions 5.0.x prior to 5.0.6, versions 4.3.x prior to 4.3.17, and older unsupported versions allows applications to expose STOMP over WebSocket endpoints with a simple, in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a regular expression, denial of service attack. Spring Framework, en versiones 5.0.x anteriores a la 5.0.6, versiones 4.3.x anteriores a la 4.3.17 y versiones antiguas no soportadas, permite que las aplicaciones expongan STOMP sobre los endpoints WebSocket con un simple broker STOP dentro de la memoria a través del módulo spring-messaging. Un usuario (o atacante) malicioso puede crear un mensaje para el broker que puede conducir a un ataque de denegación de servicio (DoS) de expresión regular. • http://www.oracle.com/technetwork/security-advisory/cpuoct2018-4428296.html http://www.securityfocus.com/bid/104260 https://access.redhat.com/errata/RHSA-2018:1809 https://access.redhat.com/errata/RHSA-2018:3768 https://pivotal.io/security/cve-2018-1257 https://www.oracle.com/security-alerts/cpujan2020.html https://www.oracle.com/security-alerts/cpujul2020.html https://www.oracle.com/security-alerts/cpuoct2021.html https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html ht • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.3EPSS: 0%CPEs: 4EXPL: 0CVE-2017-2611
https://notcve.org/view.php?id=CVE-2017-2611
Jenkins before versions 2.44, 2.32.2 is vulnerable to an insufficient permission check for periodic processes (SECURITY-389). The URLs /workspaceCleanup and /fingerprintCleanup did not perform permission checks, allowing users with read access to Jenkins to trigger these background processes (that are otherwise performed daily), possibly causing additional load on Jenkins master and agents. Jenkins en versiones anteriores a la 2.44, 2.32.2 es vulnerable a una exposición de información en la API interna que permite el acceso a los nombres de los elementos que no deberían ser visibles (SECURITY-380). Esto solo afecta a los usuarios anónimos (otros usuarios tienen acceso legítimo) que podrían obtener una lista de los elementos mediante un UnprotectedRootAction. • http://www.securityfocus.com/bid/95956 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2611 https://github.com/jenkinsci/jenkins/commit/97a61a9fe55f4c16168c123f98301a5173b9fa86 https://jenkins.io/security/advisory/2017-02-01 • CWE-358: Improperly Implemented Security Check for Standard CWE-863: Incorrect Authorization •