CVE-2016-3708
HighSummary
Red Hat OpenShift Enterprise 3.2 with multi-tenant SDN enabled allows remote authenticated users to access network resources on restricted pods when a build is run in a namespace that would normally be isolated from other pods. The issue occurs with builder images that contain ONBUILD commands or lack a tar binary.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive network resources, potentially leading to data breaches and other security threats.
Recommendation
It is recommended to review and restrict the use of builder images containing ONBUILD commands and ensure that images include necessary binaries like tar to minimize risk.
Other vulnerabilities in Red Hat OpenShift Enterprise 3.2
See all- CVE-2016-5409High
Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies.
- CVE-2016-3738High
Red Hat OpenShift Enterprise 3.2 improperly restricts access to STI builds, allowing remote authenticated users to access the Docker socket and gain privileges via vectors related to build-pod.
- CVE-2015-5222High
Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, allowing remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods.
- CVE-2014-3674High
Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, allowing remote attackers to access the network resources of arbitrary gears via unspecified vectors.
Original NVD description (English source)
Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespaces, allows remote authenticated users to access network resources on restricted pods via an s2i build with a builder image that (1) contains ONBUILD commands or (2) does not contain a tar binary.