Information Disclosure

🗓️ 27 Apr 2017 07:33:59Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 20 Views

github.com/openshift/origin is vulnerable to information disclosure. The HAproxy puts the internal IP address of a pod into the `OPENSHIFT_[namespace]_SERVERID` cookie, allowing local users to obtain this information

Reporter	Title	Published	Views	Family All 15
CNVD	Red Hat OpenShift Enterprise HAProxy Information Disclosure Vulnerability	15 May 201600:00	–	cnvd
CVE	CVE-2016-3711	8 Jun 201617:00	–	cve
Cvelist	CVE-2016-3711	8 Jun 201617:00	–	cvelist
EUVD	EUVD-2016-4732	7 Oct 202500:30	–	euvd
NVD	CVE-2016-3711	8 Jun 201617:59	–	nvd
OSV	CVE-2016-3711	8 Jun 201617:59	–	osv
OSV	RHSA-2016:1064 Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.2 security, bug fix, and enhancement update	15 Sep 202423:18	–	osv
Prion	Code injection	8 Jun 201617:59	–	prion
Positive Technologies	PT-2016-5671 · Red Hat +1 · Openshift Origin +2	8 Jun 201600:00	–	ptsecurity
Tenable Nessus	RHEL 7 : Red Hat OpenShift Enterprise 3.2 (RHSA-2016:1064)	4 Dec 201800:00	–	nessus

Vulners

Node

openshift originMatchhead

-nodejs-osenvMatch0.0.3_5.el7

-nodejs-json-stringify-safeMatch5.0.0_1.el7

-nodejs-mimeMatch1.2.11_1.el7

-python-mimeparseMatch0.1.4_1.el7ost

-nodejs-sntpMatch0.2.4_1.el7

jenkins jenkinsMatch1.625.3_2.el7aos

-openshift-elasticsearch-pluginMatch0.7.0.redhat_1_1.el7

-nodejs-read-all-streamMatch1.0.2_1.el7

-nodejs-stream-combinerMatch0.2.1_1.el7

-nodejs-raw-bodyMatch1.1.4_1.el7

-nodejs-optimistMatch0.4.0_1.el7

nodejs node.jsMatch0.5.4_2.el7rc.3

-nodejs-wordwrapMatch0.0.2_4.el7

getadigital nested-object-assignMatch2.0.0_2.el7node.js

getadigital nested-object-assignMatch2.0.0_3.el7aosnode.js

-nodejs-minimistMatch0.0.1_2.el7

-nodejs-boomMatch0.4.2_2.el7

-nodejs-commanderMatch2.2.0_1.el7

-nodejs-splitMatch0.3.3_1.el7

elasticsearch elasticsearchMatch0.90.10_6.el7sat

elasticsearch elasticsearchMatch0.90.10_7.el7

-nodejs-globMatch3.2.6_1.el7

-rubygem-fluent-plugin-elasticsearchMatch0.7.0_1.el7ost

-rubygem-fluent-plugin-elasticsearchMatch1.0.0_2.el7aos

-nodejs-findup-syncMatch0.1.3_1.el7

ansible ansibleMatch1.9.3_2.el7aos

-nodejs-is-streamMatch1.0.1_1.el7

-nodejs-mkdirpMatch0.3.5_3.el7

-nodejs-has-colorMatch0.1.7_1.el7

-nodejs-debugMatch0.8.1_1.el7

-nodejs-pause-streamMatch0.0.11_1.el7

-nodejs-minimatchMatch0.2.12_2.el7

-nodejs-asyncMatch0.2.10_1.el7

-nodejs-blMatch0.9.3_1.el7

-nodejs-fromMatch0.1.3_1.el7

-heapsterMatch0.18.2_3.gitaf4752e.el7aos

-heapsterMatch0.18.2_2.gitaf4752e.el7aos

-nodejs-requestMatch2.25.0_1.el7

-nodejs-normalize-pathMatch0.3.0_1.el7

-nodejs-readable-streamMatch1.1.9_1.el7

-nodejs-chalkMatch0.4.0_2.el7

-python-linecache2Match1.0.0_1.el7ost

-nodejs-pinkie-promiseMatch1.0.0_1.el7

cookie-signature_project cookie-signatureMatch1.0.3_1.el7node.js

fluentd fluentdMatch0.12.5_3.el7ost

fluentd fluentdMatch0.12.16_1.el7aos

search-guard search_guardMatch0.5.0.redhat_1_1.el7

-nodejs-event-streamMatch3.1.7_1.el7

-nodejs-merge-descriptorsMatch0.0.2_1.el7

-nodejs-freshMatch0.2.2_1.el7

-nodejs-cryptilesMatch0.2.2_1.el7

-nodejs-qsMatch0.6.6_3.el7

-nodejs-inheritsMatch2.0.0_4.el7

-nodejs-methodsMatch0.1.0_1.el7

-nodejs-hawkMatch1.0.0_1.el7

-nodejs-iconv-liteMatch0.2.11_1.el7

-nodejs-concat-streamMatch1.4.4_2.el7

-nodejs-statusesMatch1.2.1_1.el7

-nodejs-hoekMatch0.9.1_1.el7

-nodejs-delayed-streamMatch0.0.5_5.el7

-elastic-curatorMatch3.2.3_1.el7

-nodejs-slideMatch1.1.5_1.el7

-nodejs-strip-ansiMatch0.2.0_1.el7

rest-client_project rest-clientMatch1.6.7_1.el7satruby

-nodejs-gotMatch2.2.0_3.el7

-nodejs-msMatch0.6.2_1.el7

-nodejs-pinkieMatch1.0.0_1.el7

kibanaMatch3.1.2_2.el7ost

-rubygem-multi_jsonMatch1.8.2_4.el7sat

-rubygem-multi_jsonMatch1.7.1_1.el7

-nodejs-bytesMatch0.3.0_1.el7

-nodejs-yargsMatch1.3.3_1.el7

-nodejs-sendMatch0.3.0_4.el7

kind-of_project kind-ofMatch2.0.1_1.el7aos

-nodejs-align-textMatch0.1.3_1.el7aos

-python-unittest2Match1.1.0_4.el7

-python-unittest2Match1.0.1_1.el7ost

-python-unittest2Match0.5.1_7.el7ev

-nodejs-form-dataMatch0.1.1_1.el7

-nodejs-asn1Match0.1.11_3.el7

-nodejs-morganMatch1.0.0_2.el7

-nodejs-registry-urlMatch2.0.0_3.el7

-nodejs-cookieMatch0.1.2_1.el7

-nodejs-lowercase-keysMatch1.0.0_1.el7

-nodejs-ansi-stylesMatch1.0.0_1.el7

httplib2_project httplib2Match0.7.7_3.el7ostpython

httplib2_project httplib2Match0.6.0_6.el7satpython

-nodejs-iniMatch1.1.0_3.el7

-nodejs-graceful-fsMatch2.0.0_2.el7

node-uuid_project node-uuidMatch1.4.1_1.el7node.js

-nodejs-onceMatch1.1.1_5.el7

-nodejs-tunnel-agentMatch0.3.0_1.el7

-nodejs-negotiatorMatch0.4.3_1.el7

-rubygem-rackMatch1.4.1_13.el7sat

-origin-kibanaMatch0.4_3.el7aos

-nodejs-oauth-signMatch0.3.0_1.el7

cockpitMatch0.77_3.el7

-nodejs-combined-streamMatch0.0.4_3.el7

-nodejs-supports-colorMatch1.2.0_2.el7

-nodejs-resolveMatch0.5.0_1.el7

-nodejs-duplexifyMatch3.2.0_2.el7

-nodejs-throughMatch2.3.4_2.el7

-nodejs-extendMatch1.3.0_1.el7

-python-contextlib2Match0.4.0_2.el7ost

joyent http-signatureMatch0.10.0_3.el7node.js

-nodejs-map-streamMatch0.0.5_1.el7

-nodejs-range-parserMatch1.0.0_1.el7

openvswitch openvswitchMatch2.1.2_2.el7_0.2

openvswitch openvswitchMatch2.0.0_7.el7

openvswitch openvswitchMatch2.3.2_1.git20150730.el7_1

openvswitch openvswitchMatch2.3.1_2.git20150113.el7

openvswitch openvswitchMatch2.4.0_1.el7

openvswitch openvswitchMatch2.1.2_2.el7_0.1

-v8Match3.14.5.10_11.el7sat

-v8Match3.14.5.10_2.el7ost

-python-pbrMatch0.10.8_1.el7

-python-pbrMatch0.7.0_1.el7

-python-pbrMatch1.8.0_1.el7ost

atomic-openshiftMatch3.1.1.6_4.git.32.adf8ec9.el7aos

atomic-openshiftMatch3.1.1.6_6.git.43.f583589.el7aos

atomic-openshiftMatch3.1.0.4_1.git.10.ec10652.el7aos

atomic-openshiftMatch3.1.1.6_3.git.16.5327e56.el7aos

atomic-openshiftMatch3.1.1.6_1.git.0.b57e8bd.el7aos

atomic-openshiftMatch3.1.1.6_4.git.21.cd70c35.el7aos

atomic-openshiftMatch3.1.0.4_1.git.15.5e061c3.el7aos

atomic-openshiftMatch3.1.0.4_1.git.4.b6c7cd2.el7aos

-nodejs-forever-agentMatch0.5.0_1.el7

-python-elasticsearchMatch1.4.0_2.el7ost

-nodejs-prepend-httpMatch1.0.1_1.el7

-nodejs-semverMatch2.1.0_3.el7

-nodejs-readdirpMatch0.4.0_1.el7

-nodejs-noptMatch2.1.2_1.el7

python_software_foundation paramikoMatch1.15.1_1.el7

python_software_foundation paramikoMatch1.7.7.1_3.el7

python_software_foundation paramikoMatch1.15.1_2.el7ost

python_software_foundation paramikoMatch1.15.1_1.el7ost

python_software_foundation paramikoMatch1.11.3_1.el7ost