PT-2020-10147 · Red Hat · Openshift/Ocp-Release-Operator-Sdk +2

Name of the Vulnerable Software and Affected Versions: openshift/ocp-release-operator-sdk affected versions not specified openshift/ansible-operator-container as shipped in Openshift 4 affected versions not specified Description: An insecure modification vulnerability in the /etc/passwd file was...

Insecure File Permissions

github.com/openshift/ocp-release-operator-sdk configures an insecure file permission for /etc/passwd. Any local user is able to modify the contents within the /etc/passwd file. This allows an attacker to escalate privileges by creating a new user with higher privileges and switching to the new us...

CVE-2019-19355

An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges...

CVE-2019-11324

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use o...

CVE-2018-11235

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because...

CVE-2018-1069

GlusterFS and NFS network filesystems rely on File System User ID and Group ID information in order to restrict access to file shares. However, it's possible to overwrite the Openshift restrictions on container UserId and GroupdId as they are not validated before being sent over the Openshift...

CVE-2008-5997

Absolute path traversal vulnerability in admin/fileKontrola/browser.asp in Omnicom Content Platform OCP 2.0 allows remote attackers to list arbitrary directories via a full pathname in the root parameter...

CVE-2008-5997

CVE-2008-5997: Absolute path traversal in Omnicom Content Platform (OCP) 2.0 — vulnerable code path is admin/fileKontrola/browser.asp. The root parameter can be used remotely to enumerate directories. Connected sources confirm the vulnerability and impact (directory listing/CONF disclosure); no e...

omnicom-traverse.txt

================================================================================ |||||||||||||Omnicom Content Platform Local Directory Traversal||||||||||||||||| ================================================================================...