Red Hat OpenShift Enterprise 3.2 vulnerabilities
5 known CVE vulnerabilities in Red Hat OpenShift Enterprise 3.2, translated and rated.
- CVE-2016-5409High
Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies.
- CVE-2016-3738High
Red Hat OpenShift Enterprise 3.2 improperly restricts access to STI builds, allowing remote authenticated users to access the Docker socket and gain privileges via vectors related to build-pod.
- CVE-2016-3708High
Red Hat OpenShift Enterprise 3.2 with multi-tenant SDN enabled allows remote authenticated users to access network resources on restricted pods when a build is run in a namespace that would normally be isolated from other pods. The issue occurs with builder images that contain ONBUILD commands or lack a tar binary.
- CVE-2015-5222High
Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, allowing remote authenticated users with build permissions to execute arbitrary shell commands with root permissions on arbitrary build pods.
- CVE-2014-3674High
Red Hat OpenShift Enterprise before 2.2 does not properly restrict access to gears, allowing remote attackers to access the network resources of arbitrary gears via unspecified vectors.