CVE-2018-1102

A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.

Mitigation

Customers can turn off the source-to-image (S2I) build strategy to prevent access to the exploitable function. Information about how to disable the source-to-image build strategy is in the product documentation.

• Disabling S2I in OpenShift Enterprise 3.0 - <https://docs.openshift.com/enterprise/3.0/admin_guide/securing_builds.html#disabling-a-build-strategy-globally&gt;
• Disabling S2I in OpenShift Enterprise 3.1 - <https://docs.openshift.com/enterprise/3.1/admin_guide/securing_builds.html#disabling-a-build-strategy-globally&gt;
• Disabling S2I in OpenShift Enterprise 3.2 - <https://docs.openshift.com/enterprise/3.2/admin_guide/securing_builds.html#disabling-a-build-strategy-globally&gt;
• Disabling S2I in OpenShift Enterprise 3.3 - <https://access.redhat.com/documentation/en-us/openshift_container_platform/3.3/html/cluster_administration/admin-guide-securing-builds&gt;
• Disabling S2I in OpenShift Enterprise 3.4 - <https://access.redhat.com/documentation/en-us/openshift_container_platform/3.4/html/cluster_administration/admin-guide-securing-builds&gt;
• Disabling S2I in OpenShift Enterprise 3.5 - <https://access.redhat.com/documentation/en-us/openshift_container_platform/3.5/html/cluster_administration/admin-guide-securing-builds&gt;
• Disabling S2I in OpenShift Enterprise 3.6 - <https://access.redhat.com/documentation/en-us/openshift_container_platform/3.6/html/cluster_administration/admin-guide-securing-builds&gt;
• Disabling S2I in OpenShift Enterprise 3.7 - <https://access.redhat.com/documentation/en-us/openshift_container_platform/3.7/html/cluster_administration/admin-guide-securing-builds&gt;
• OpenShift Enterprise 3.8 is not a production version (only for upgrades).
• Disabling S2I in OpenShift Enterprise 3.9 - <https://access.redhat.com/documentation/en-us/openshift_container_platform/3.9/html/cluster_administration/admin-guide-securing-builds&gt;