Moderate: Red Hat Security Advisory: Red Hat OpenShift Application Runtimes security and bug fix update

An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2016-8651

An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image...

Input validation

An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image...

CVE-2016-8651

An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image...

CVE-2016-8651

An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image...

CVE-2016-8651

CVE-2016-8651 describes an input validation flaw in OpenShift 3 where a user with a copy of an image manifest can pull an image they normally cannot access, potentially disclosing information contained in the image. The issue is tied to how OpenShift handles image-related requests and is document...

com.openshift.jenkins:openshift-pipeline (>=1.0.22, <=1.0.57), io.fabric8.jenkins.plugins:openshift-sync (>=0.0.8, <=1.0.42) potentially affected by CVE-2018-1999040 via org.csanchez.jenkins.plugins:kubernetes (>=0.6, <=0.10)

org.csanchez.jenkins.plugins:kubernetes MAVEN version =0.6, =1.0.22, =0.0.8, =1.0.42 Source cves: CVE-2018-1999040 Source advisory: MEND:CVE-2018-1999040...

PT-2018-5046 · Red Hat · Openshift

Name of the Vulnerable Software and Affected Versions: OpenShift 3 affected versions not specified Description: An input validation flaw in OpenShift 3 allows a user to pull an image even without normal access, by using a copy of the manifest associated with the image. This results in the...

CVE-2016-8651: Improper Input Validation

An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image...

Design/Logic Flaw

The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site...

CVE-2016-8631

The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site...

CVE-2016-8631

The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site...

CVE-2016-8631

CVE-2016-8631 affects the OpenShift router in OpenShift Container Platform 3 (and OpenShift Enterprise 3) where routes are not sorted correctly when new routes are added. The underlying issue allows a user with permission to create routes to potentially overwrite existing routes and redirect traf...

CVE-2016-8631

The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site...

PT-2018-5038 · Red Hat · Openshift Enterprise

Name of the Vulnerable Software and Affected Versions: OpenShift Enterprise 3 affected versions not specified Description: The issue arises from the OpenShift Enterprise 3 router's failure to properly sort routes when processing new additions. This allows an attacker with route creation access to...

CVE-2016-8631: Improper Input Validation

The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site...

Low: Red Hat Bug Fix Advisory: OpenShift Container Platform 3.10 RPM Release Advisory

Red Hat OpenShift Container Platform 3.10, which fixes several bugs and includes various enhancements, is now available. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. The OpenShift...

Design/Logic Flaw

A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the...

CVE-2017-12195

A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the...

CVE-2017-12195

A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the...