OpenShift vulnerabilities

Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.

The Route resource in OpenShift allows defining routes to expose pods via HAProxy. Insufficient validation of the spec.path field in a Route document could allow controlled injection of HAProxy configuration.

A flaw in the OpenShift build process mounts the host's /var/lib/kubelet/config.json file into the docker-build container with write access. This allows an attacker to overwrite the file containing sensitive credentials for pulling images from private repositories.