CVE-2016-9592

The CVE-2016-9592 entry describes a denial-of-service risk in OpenShift before versions 3.3.1.11, 3.2.1.23, and 3.4. The root cause is a flaw where a volume fails to detach, causing the delete operation to fail with a VolumeInUse error. Because the delete operation is retried every 30 seconds for...

CVE-2016-9592: Improper Cleanup on Thrown Exception

openshift before versions 3.3.1.11, 3.2.1.23, 3.4 is vulnerable to a flaw when a volume fails to detach, which causes the delete operation to fail with 'VolumeInUse' error. Since the delete operation is retried every 30 seconds for each volume, this could lead to a denial of service attack as the...

Chapter 2. OpenShift Container Platform 3.5 Release Notes - OpenShift Container Platform 3.5 Release Notes

No description provided...

Release Notes - OpenShift Container Platform 3.5 Release Notes

No description provided...

Red Hat OpenShift Enterprise HTML Injection Vulnerability

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that builds, tests, deploys, and runs applications.OpenShift Enterprise is an open source version of the private cloud. An HTML injection vulnerability exists in Red Hat OpenShift Enterprise. The...

Design/Logic Flaw

OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user input, specifically terminal escape characters, and the creation of clickable links automatically when viewing the log files for a pod...

CVE-2017-7534

OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user input, specifically terminal escape characters, and the creation of clickable links automatically when viewing the log files for a pod...

CVE-2017-7534

OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user input, specifically terminal escape characters, and the creation of clickable links automatically when viewing the log files for a pod...

CVE-2017-7534

OpenShift Enterprise 3.x contains a stored cross-site scripting (XSS) vulnerability in the pod log viewer. The issue arises from inadequate sanitization of user input, specifically terminal escape characters, which can cause clickable links to be created when viewing pod logs. The vulnerability a...

CVE-2017-7534

OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user input, specifically terminal escape characters, and the creation of clickable links automatically when viewing the log files for a pod...

CVE-2017-15137

The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed...

CVE-2017-7534: Improper Neutralization of Input During Web Page Generation

OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user input, specifically terminal escape characters, and the creation of clickable links automatically when viewing the log files for a pod...

CVE-2017-7534

OpenShift Enterprise is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user input, specifically terminal escape characters, and the creation of clickable links automatically when viewing the log files for a pod...

(RHSA-2018:1072) Low: Kubernetes in the Extras channel - deprecation notice

The kubernetes packages provide utilities for container cluster management. Kubernetes and its dependencies will no longer be updated through the Extras channel. Instead, the Red Hat customers are advised to use Red Hat's supported Kubernetes-based products such as Red Hat OpenShift Container...

Moderate: Red Hat Bug Fix Advisory: Red Hat OpenShift Container Platform 3.9 RPM Release Advisory

Red Hat OpenShift Container Platform 3.9, which fixes several bugs and includes various enhancements, is now available. Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service PaaS solution designed for on-premise or private cloud deployments. The OpenShift...

atomic-openshift: cluster-reader can escalate to creating builds via webhooks in any project

An improper authorization flaw in the atomic-openshift component of Openshift Container Platform 3.7 and earlier allows a user with cluster-reader project viewer permissions to trigger an application build. An attacker could use this flaw to trigger a build of an application when that should be...

atomic-openshift: image import whitelist can be bypassed by creating an imagestream or using oc tag

The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed...

CVE-2018-1085

OpenShift and Atomic Enterprise Ansible deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCDCLIENTCERTAUTH and ETCDPEERCLIENTCERTAUTH in etcd.conf result in etcd being configured to allow remote users to conne...

Red Hat OpenShift Enterprise Elevation of Privilege Vulnerability

Red Hat OpenShift is a Platform-as-a-Service PaaS cloud computing platform from Red Hat, Inc. that builds, tests, deploys, and runs applications.OpenShift Enterprise is an open source version of the private cloud. A security vulnerability exists in Red Hat OpenShift Enterprise version 3.7. An...

Important: Red Hat Security Advisory: Red Hat OpenShift Container Platform security update

An update is now available for Red Hat OpenShift Container Platform 3.7, 3.6, 3.5, 3.4, and 3.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...