Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2016-3703 (GCVE-0-2016-3703)
Vulnerability from cvelistv5
Published
2016-06-08 17:00
Modified
2024-08-06 00:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.
References
► | URL | Tags | |
---|---|---|---|
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T00:03:34.425Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2016:1094", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2016:1094" }, { "name": "RHSA-2016:1095", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "https://access.redhat.com/errata/RHSA-2016:1095" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2016-05-19T00:00:00", "descriptions": [ { "lang": "en", "value": "Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2016-06-08T16:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2016:1094", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2016:1094" }, { "name": "RHSA-2016:1095", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "https://access.redhat.com/errata/RHSA-2016:1095" } ] } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2016-3703", "datePublished": "2016-06-08T17:00:00", "dateReserved": "2016-03-30T00:00:00", "dateUpdated": "2024-08-06T00:03:34.425Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2016-3703\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2016-06-08T17:59:04.703\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.\"},{\"lang\":\"es\",\"value\":\"Red Hat OpenShift Enterprise 3.2 y 3.1 no valida correctamente el origen de una petici\u00f3n cuando el acceso an\u00f3nimo est\u00e1 concedido para una API service/proxy o pod/proxy para un pod espec\u00edfico, lo que permite a atacantes remotos acceder a credenciales de la API en el explorador web localStorage a trav\u00e9s de un token de acceso en el par\u00e1metro query.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:S/C:P/I:N/A:N\",\"baseScore\":3.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":6.8,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-284\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openshift:3.1:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"F8E35FAB-695F-44DA-945D-60B47C1F200B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openshift:3.2:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"F33CEF04-05FA-444C-BB14-F3E3434AF61F\"}]}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1094\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1095\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1094\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2016:1095\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
fkie_cve-2016-3703
Vulnerability from fkie_nvd
Published
2016-06-08 17:59
Modified
2025-04-12 10:46
Severity ?
Summary
Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.
References
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:a:redhat:openshift:3.1:*:*:*:enterprise:*:*:*", "matchCriteriaId": "F8E35FAB-695F-44DA-945D-60B47C1F200B", "vulnerable": true }, { "criteria": "cpe:2.3:a:redhat:openshift:3.2:*:*:*:enterprise:*:*:*", "matchCriteriaId": "F33CEF04-05FA-444C-BB14-F3E3434AF61F", "vulnerable": true } ], "negate": false, "operator": "OR" } ] } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter." }, { "lang": "es", "value": "Red Hat OpenShift Enterprise 3.2 y 3.1 no valida correctamente el origen de una petici\u00f3n cuando el acceso an\u00f3nimo est\u00e1 concedido para una API service/proxy o pod/proxy para un pod espec\u00edfico, lo que permite a atacantes remotos acceder a credenciales de la API en el explorador web localStorage a trav\u00e9s de un token de acceso en el par\u00e1metro query." } ], "id": "CVE-2016-3703", "lastModified": "2025-04-12T10:46:40.837", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "LOW", "cvssData": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0" }, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ], "cvssMetricV30": [ { "cvssData": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2016-06-08T17:59:04.703", "references": [ { "source": "secalert@redhat.com", "tags": [ "Vendor Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2016:1094" }, { "source": "secalert@redhat.com", "tags": [ "Vendor Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2016:1095" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Vendor Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2016:1094" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Vendor Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2016:1095" } ], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-284" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
rhsa-2016:1094
Vulnerability from csaf_redhat
Published
2016-05-19 20:12
Modified
2024-11-22 10:05
Summary
Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.2 security update
Notes
Topic
An update for atomic-openshift and nodejs-node-uuid is now available for Red Hat OpenShift Enterprise 3.2. In addition, all images have been rebuilt on the new RHEL 7.2.4 base image.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.
Security Fix(es):
* A vulnerability was found in the STI build process in OpenShift Enterprise. Access to STI builds was not properly restricted, allowing an attacker to use STI builds to access the Docker socket and escalate their privileges. (CVE-2016-3738)
* An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser's localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized access_token was provided in the query parameter. (CVE-2016-3703)
* A flaw was found in OpenShift Enterprise when multi-tenant SDN is enabled and a build is run within a namespace that would normally be isolated from pods in other namespaces. If an s2i build is run in such an environment the container being built can access network resources on pods that should not be available to it. (CVE-2016-3708)
The CVE-2016-3738 issue was discovered by David Eads (Red Hat); the CVE-2016-3703 issue was discovered by Jordan Liggitt (Red Hat); and the CVE-2016-3708 issue was discovered by Ben Parees (Red Hat).
This update includes the following images:
openshift3/ose:v3.2.0.44-2
openshift3/ose-deployer:v3.2.0.44-2
openshift3/ose-docker-builder:v3.2.0.44-2
openshift3/ose-docker-registry:v3.2.0.44-2
openshift3/ose-f5-router:v3.2.0.44-2
openshift3/ose-haproxy-router:v3.2.0.44-2
openshift3/ose-keepalived-ipfailover:v3.2.0.44-2
openshift3/ose-pod:v3.2.0.44-2
openshift3/ose-recycler:v3.2.0.44-2
openshift3/ose-sti-builder:v3.2.0.44-2
openshift3/jenkins-1-rhel7:1.642-32
openshift3/logging-auth-proxy:3.2.0-4
openshift3/logging-deployment:3.2.0-9
openshift3/logging-elasticsearch:3.2.0-8
openshift3/logging-fluentd:3.2.0-8
openshift3/logging-kibana:3.2.0-4
openshift3/metrics-deployer:3.2.0-6
openshift3/metrics-heapster:3.2.0-6
openshift3/mongodb-24-rhel7:2.4-28
openshift3/mysql-55-rhel7:5.5-26
openshift3/nodejs-010-rhel7:0.10-35
openshift3/node:v3.2.0.44-2
openshift3/openvswitch:v3.2.0.44-2
openshift3/perl-516-rhel7:5.16-38
openshift3/php-55-rhel7:5.5-35
openshift3/postgresql-92-rhel7:9.2-25
openshift3/python-33-rhel7:3.3-35
openshift3/ruby-20-rhel7:2.0-35
aep3_beta/aep:v3.2.0.44-2
aep3_beta/aep-deployer:v3.2.0.44-2
aep3_beta/aep-docker-registry:v3.2.0.44-2
aep3_beta/aep-f5-router:v3.2.0.44-2
aep3_beta/aep-haproxy-router:v3.2.0.44-2
aep3_beta/aep-keepalived-ipfailover:v3.2.0.44-2
aep3_beta/aep-pod:v3.2.0.44-2
aep3_beta/aep-recycler:v3.2.0.44-2
aep3_beta/logging-auth-proxy:3.2.0-4
aep3_beta/logging-deployment:3.2.0-9
aep3_beta/logging-elasticsearch:3.2.0-8
aep3_beta/logging-fluentd:3.2.0-8
aep3_beta/logging-kibana:3.2.0-4
aep3_beta/metrics-deployer:3.2.0-6
aep3_beta/metrics-heapster:3.2.0-6
aep3_beta/node:v3.2.0.44-2
aep3_beta/openvswitch:v3.2.0.44-2
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for atomic-openshift and nodejs-node-uuid is now available for Red Hat OpenShift Enterprise 3.2. In addition, all images have been rebuilt on the new RHEL 7.2.4 base image.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenShift Enterprise by Red Hat is the company\u0027s cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.\n\nSecurity Fix(es):\n\n* A vulnerability was found in the STI build process in OpenShift Enterprise. Access to STI builds was not properly restricted, allowing an attacker to use STI builds to access the Docker socket and escalate their privileges. (CVE-2016-3738)\n\n* An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser\u0027s localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized access_token was provided in the query parameter. (CVE-2016-3703)\n\n* A flaw was found in OpenShift Enterprise when multi-tenant SDN is enabled and a build is run within a namespace that would normally be isolated from pods in other namespaces. If an s2i build is run in such an environment the container being built can access network resources on pods that should not be available to it. (CVE-2016-3708)\n\nThe CVE-2016-3738 issue was discovered by David Eads (Red Hat); the CVE-2016-3703 issue was discovered by Jordan Liggitt (Red Hat); and the CVE-2016-3708 issue was discovered by Ben Parees (Red Hat).\n\nThis update includes the following images:\n\nopenshift3/ose:v3.2.0.44-2\nopenshift3/ose-deployer:v3.2.0.44-2\nopenshift3/ose-docker-builder:v3.2.0.44-2\nopenshift3/ose-docker-registry:v3.2.0.44-2\nopenshift3/ose-f5-router:v3.2.0.44-2\nopenshift3/ose-haproxy-router:v3.2.0.44-2\nopenshift3/ose-keepalived-ipfailover:v3.2.0.44-2\nopenshift3/ose-pod:v3.2.0.44-2\nopenshift3/ose-recycler:v3.2.0.44-2\nopenshift3/ose-sti-builder:v3.2.0.44-2\nopenshift3/jenkins-1-rhel7:1.642-32\nopenshift3/logging-auth-proxy:3.2.0-4\nopenshift3/logging-deployment:3.2.0-9\nopenshift3/logging-elasticsearch:3.2.0-8\nopenshift3/logging-fluentd:3.2.0-8\nopenshift3/logging-kibana:3.2.0-4\nopenshift3/metrics-deployer:3.2.0-6\nopenshift3/metrics-heapster:3.2.0-6\nopenshift3/mongodb-24-rhel7:2.4-28\nopenshift3/mysql-55-rhel7:5.5-26\nopenshift3/nodejs-010-rhel7:0.10-35\nopenshift3/node:v3.2.0.44-2\nopenshift3/openvswitch:v3.2.0.44-2\nopenshift3/perl-516-rhel7:5.16-38\nopenshift3/php-55-rhel7:5.5-35\nopenshift3/postgresql-92-rhel7:9.2-25\nopenshift3/python-33-rhel7:3.3-35\nopenshift3/ruby-20-rhel7:2.0-35\n\naep3_beta/aep:v3.2.0.44-2\naep3_beta/aep-deployer:v3.2.0.44-2\naep3_beta/aep-docker-registry:v3.2.0.44-2\naep3_beta/aep-f5-router:v3.2.0.44-2\naep3_beta/aep-haproxy-router:v3.2.0.44-2\naep3_beta/aep-keepalived-ipfailover:v3.2.0.44-2\naep3_beta/aep-pod:v3.2.0.44-2\naep3_beta/aep-recycler:v3.2.0.44-2\naep3_beta/logging-auth-proxy:3.2.0-4\naep3_beta/logging-deployment:3.2.0-9\naep3_beta/logging-elasticsearch:3.2.0-8\naep3_beta/logging-fluentd:3.2.0-8\naep3_beta/logging-kibana:3.2.0-4\naep3_beta/metrics-deployer:3.2.0-6\naep3_beta/metrics-heapster:3.2.0-6\naep3_beta/node:v3.2.0.44-2\naep3_beta/openvswitch:v3.2.0.44-2", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2016:1094", "url": "https://access.redhat.com/errata/RHSA-2016:1094" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1306011", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1306011" }, { "category": "external", "summary": "1318974", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1318974" }, { "category": "external", "summary": "1324996", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1324996" }, { "category": "external", "summary": "1329044", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1329044" }, { "category": "external", "summary": "1330233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1330233" }, { "category": "external", "summary": "1330364", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1330364" }, { "category": "external", "summary": "1331229", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1331229" }, { "category": "external", "summary": "1333168", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333168" }, { "category": "external", "summary": "1333461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333461" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1094.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.2 security update", "tracking": { "current_release_date": "2024-11-22T10:05:35+00:00", "generator": { "date": "2024-11-22T10:05:35+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2016:1094", "initial_release_date": "2016-05-19T20:12:26+00:00", "revision_history": [ { "date": "2016-05-19T20:12:26+00:00", "number": "1", "summary": "Initial version" }, { "date": "2016-05-19T20:12:27+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T10:05:35+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 3.2", "product": { "name": "Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3.2::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "nodejs-node-uuid-0:1.4.7-1.el7.noarch", "product": { "name": "nodejs-node-uuid-0:1.4.7-1.el7.noarch", "product_id": "nodejs-node-uuid-0:1.4.7-1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-node-uuid@1.4.7-1.el7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "nodejs-node-uuid-0:1.4.7-1.el7.src", "product": { "name": "nodejs-node-uuid-0:1.4.7-1.el7.src", "product_id": "nodejs-node-uuid-0:1.4.7-1.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/nodejs-node-uuid@1.4.7-1.el7?arch=src" } } }, { "category": "product_version", "name": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "product": { "name": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "product_id": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.2.0.44-1.git.0.a4463d9.el7?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product": { "name": "atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_id": "atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-node@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product": { "name": "atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_id": "atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-master@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product": { "name": "atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_id": "atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-recycle@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product": { "name": "atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_id": "atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients-redistributable@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product": { "name": "atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_id": "atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-dockerregistry@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product": { "name": "atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_id": "atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product": { "name": "atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_id": "atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-pod@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64" } } }, { "category": "product_version", "name": "tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product": { "name": "tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_id": "tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/tuned-profiles-atomic-openshift-node@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product": { "name": "atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_id": "atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-tests@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product": { "name": "atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_id": "atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product": { "name": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_id": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src" }, "product_reference": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" }, "product_reference": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" }, "product_reference": "atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" }, "product_reference": "atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" }, "product_reference": "atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" }, "product_reference": "atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" }, "product_reference": "atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" }, "product_reference": "atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" }, "product_reference": "atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" }, "product_reference": "atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" }, "product_reference": "atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-node-uuid-0:1.4.7-1.el7.noarch as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch" }, "product_reference": "nodejs-node-uuid-0:1.4.7-1.el7.noarch", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "nodejs-node-uuid-0:1.4.7-1.el7.src as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src" }, "product_reference": "nodejs-node-uuid-0:1.4.7-1.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" }, { "category": "default_component_of", "full_product_name": { "name": "tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2", "product_id": "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" }, "product_reference": "tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.2" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Jordan Liggitt" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2016-3703", "cwe": { "id": "CWE-285", "name": "Improper Authorization" }, "discovery_date": "2016-04-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1330233" } ], "notes": [ { "category": "description", "text": "An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser\u0027s localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized access_token was provided in the query parameter.", "title": "Vulnerability description" }, { "category": "summary", "text": "3: Untrusted content loaded via the API proxy can access web console credentials on the same domain", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src", "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-3703" }, { "category": "external", "summary": "RHBZ#1330233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1330233" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-3703", "url": "https://www.cve.org/CVERecord?id=CVE-2016-3703" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3703", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3703" } ], "release_date": "2016-05-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2016-05-19T20:12:26+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src", "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2016:1094" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0" }, "products": [ "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src", "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "3: Untrusted content loaded via the API proxy can access web console credentials on the same domain" }, { "acknowledgments": [ { "names": [ "Ben Parees" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2016-3708", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2016-04-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1331229" } ], "notes": [ { "category": "description", "text": "A flaw was found in OpenShift Enterprise when multi-tenant SDN is enabled and a build is run within a namespace that would normally be isolated from pods in other namespaces. If an s2i build is run in such an environment the container being built can access network resources on pods that should not be available to it.", "title": "Vulnerability description" }, { "category": "summary", "text": "3: s2i builds implicitly perform docker builds", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src", "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-3708" }, { "category": "external", "summary": "RHBZ#1331229", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1331229" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-3708", "url": "https://www.cve.org/CVERecord?id=CVE-2016-3708" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3708", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3708" } ], "release_date": "2016-04-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2016-05-19T20:12:26+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src", "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2016:1094" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0" }, "products": [ "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src", "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "3: s2i builds implicitly perform docker builds" }, { "acknowledgments": [ { "names": [ "David Eads" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2016-3738", "cwe": { "id": "CWE-284", "name": "Improper Access Control" }, "discovery_date": "2016-05-04T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1333461" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the STI build process in OpenShift Enterprise. Access to STI builds was not properly restricted, allowing an attacker to use STI builds to access the Docker socket and escalate their privileges.", "title": "Vulnerability description" }, { "category": "summary", "text": "origin: pod update allows docker socket access via build-pod", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src", "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-3738" }, { "category": "external", "summary": "RHBZ#1333461", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333461" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-3738", "url": "https://www.cve.org/CVERecord?id=CVE-2016-3738" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3738", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3738" } ], "release_date": "2016-05-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2016-05-19T20:12:26+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src", "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2016:1094" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0" }, "products": [ "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src", "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch", "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src", "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "origin: pod update allows docker socket access via build-pod" } ] }
rhsa-2016:1095
Vulnerability from csaf_redhat
Published
2016-05-19 20:38
Modified
2024-11-22 10:05
Summary
Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.1 security update
Notes
Topic
An update for atomic-openshift is now available for Red Hat OpenShift Enterprise 3.1. In addition, all images have been rebuilt on the new RHEL 7.2.4 base image.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.
Security Fix(es):
* An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser's localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized access_token was provided in the query parameter. (CVE-2016-3703)
This issue was discovered by Jordan Liggitt (Red Hat).
This update includes the following images:
openshift3/ose:v3.1.1.6-21
openshift3/ose-deployer:v3.1.1.6-20
openshift3/ose-docker-builder:v3.1.1.6-19
openshift3/ose-docker-registry:v3.1.1.6-9
openshift3/ose-f5-router:v3.1.1.6-20
openshift3/ose-haproxy-router:v3.1.1.6-9
openshift3/ose-keepalived-ipfailover:v3.1.1.6-9
openshift3/ose-pod:v3.1.1.6-9
openshift3/ose-recycler:v3.1.1.6-9
openshift3/ose-sti-builder:v3.1.1.6-19
openshift3/logging-auth-proxy:3.1.1-9
openshift3/logging-deployment:3.1.1-17
openshift3/logging-elasticsearch:3.1.1-11
openshift3/logging-fluentd:3.1.1-11
openshift3/logging-kibana:3.1.1-8
openshift3/metrics-deployer:3.1.1-7
openshift3/metrics-heapster:3.1.1-7
openshift3/node:v3.1.1.6-20
openshift3/openvswitch:v3.1.1.6-10
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for atomic-openshift is now available for Red Hat OpenShift Enterprise 3.1. In addition, all images have been rebuilt on the new RHEL 7.2.4 base image.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "OpenShift Enterprise by Red Hat is the company\u0027s cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.\n\nSecurity Fix(es):\n\n* An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser\u0027s localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized access_token was provided in the query parameter. (CVE-2016-3703)\n\nThis issue was discovered by Jordan Liggitt (Red Hat).\n\nThis update includes the following images:\n\nopenshift3/ose:v3.1.1.6-21\nopenshift3/ose-deployer:v3.1.1.6-20\nopenshift3/ose-docker-builder:v3.1.1.6-19\nopenshift3/ose-docker-registry:v3.1.1.6-9\nopenshift3/ose-f5-router:v3.1.1.6-20\nopenshift3/ose-haproxy-router:v3.1.1.6-9\nopenshift3/ose-keepalived-ipfailover:v3.1.1.6-9\nopenshift3/ose-pod:v3.1.1.6-9\nopenshift3/ose-recycler:v3.1.1.6-9\nopenshift3/ose-sti-builder:v3.1.1.6-19\nopenshift3/logging-auth-proxy:3.1.1-9\nopenshift3/logging-deployment:3.1.1-17\nopenshift3/logging-elasticsearch:3.1.1-11\nopenshift3/logging-fluentd:3.1.1-11\nopenshift3/logging-kibana:3.1.1-8\nopenshift3/metrics-deployer:3.1.1-7\nopenshift3/metrics-heapster:3.1.1-7\nopenshift3/node:v3.1.1.6-20\nopenshift3/openvswitch:v3.1.1.6-10", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2016:1095", "url": "https://access.redhat.com/errata/RHSA-2016:1095" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1330233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1330233" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1095.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.1 security update", "tracking": { "current_release_date": "2024-11-22T10:05:40+00:00", "generator": { "date": "2024-11-22T10:05:40+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2016:1095", "initial_release_date": "2016-05-19T20:38:11+00:00", "revision_history": [ { "date": "2016-05-19T20:38:11+00:00", "number": "1", "summary": "Initial version" }, { "date": "2016-05-19T20:38:11+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T10:05:40+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Enterprise 3.1", "product": { "name": "Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3.1::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-clients-redistributable-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product": { "name": "atomic-openshift-clients-redistributable-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_id": "atomic-openshift-clients-redistributable-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients-redistributable@3.1.1.6-8.git.64.80b61da.el7aos?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-clients-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product": { "name": "atomic-openshift-clients-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_id": "atomic-openshift-clients-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-clients@3.1.1.6-8.git.64.80b61da.el7aos?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-master-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product": { "name": "atomic-openshift-master-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_id": "atomic-openshift-master-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-master@3.1.1.6-8.git.64.80b61da.el7aos?arch=x86_64" } } }, { "category": "product_version", "name": "tuned-profiles-atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product": { "name": "tuned-profiles-atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_id": "tuned-profiles-atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/tuned-profiles-atomic-openshift-node@3.1.1.6-8.git.64.80b61da.el7aos?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-recycle-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product": { "name": "atomic-openshift-recycle-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_id": "atomic-openshift-recycle-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-recycle@3.1.1.6-8.git.64.80b61da.el7aos?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product": { "name": "atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_id": "atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.1.1.6-8.git.64.80b61da.el7aos?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-pod-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product": { "name": "atomic-openshift-pod-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_id": "atomic-openshift-pod-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-pod@3.1.1.6-8.git.64.80b61da.el7aos?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product": { "name": "atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_id": "atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-node@3.1.1.6-8.git.64.80b61da.el7aos?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-dockerregistry-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product": { "name": "atomic-openshift-dockerregistry-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_id": "atomic-openshift-dockerregistry-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-dockerregistry@3.1.1.6-8.git.64.80b61da.el7aos?arch=x86_64" } } }, { "category": "product_version", "name": "atomic-openshift-sdn-ovs-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product": { "name": "atomic-openshift-sdn-ovs-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_id": "atomic-openshift-sdn-ovs-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.1.1.6-8.git.64.80b61da.el7aos?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.src", "product": { "name": "atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.src", "product_id": "atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift@3.1.1.6-8.git.64.80b61da.el7aos?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.src as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.src" }, "product_reference": "atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" }, "product_reference": "atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:atomic-openshift-clients-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" }, "product_reference": "atomic-openshift-clients-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-clients-redistributable-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:atomic-openshift-clients-redistributable-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" }, "product_reference": "atomic-openshift-clients-redistributable-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-dockerregistry-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:atomic-openshift-dockerregistry-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" }, "product_reference": "atomic-openshift-dockerregistry-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-master-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:atomic-openshift-master-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" }, "product_reference": "atomic-openshift-master-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" }, "product_reference": "atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-pod-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:atomic-openshift-pod-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" }, "product_reference": "atomic-openshift-pod-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-recycle-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:atomic-openshift-recycle-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" }, "product_reference": "atomic-openshift-recycle-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-sdn-ovs-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:atomic-openshift-sdn-ovs-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" }, "product_reference": "atomic-openshift-sdn-ovs-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" }, { "category": "default_component_of", "full_product_name": { "name": "tuned-profiles-atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64 as a component of Red Hat OpenShift Enterprise 3.1", "product_id": "7Server-RH7-RHOSE-3.1:tuned-profiles-atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" }, "product_reference": "tuned-profiles-atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.1" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Jordan Liggitt" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2016-3703", "cwe": { "id": "CWE-285", "name": "Improper Authorization" }, "discovery_date": "2016-04-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1330233" } ], "notes": [ { "category": "description", "text": "An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser\u0027s localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized access_token was provided in the query parameter.", "title": "Vulnerability description" }, { "category": "summary", "text": "3: Untrusted content loaded via the API proxy can access web console credentials on the same domain", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.1:atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.src", "7Server-RH7-RHOSE-3.1:atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-clients-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-clients-redistributable-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-dockerregistry-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-master-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-pod-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-recycle-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-sdn-ovs-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:tuned-profiles-atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-3703" }, { "category": "external", "summary": "RHBZ#1330233", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1330233" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-3703", "url": "https://www.cve.org/CVERecord?id=CVE-2016-3703" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3703", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3703" } ], "release_date": "2016-05-19T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2016-05-19T20:38:11+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RH7-RHOSE-3.1:atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.src", "7Server-RH7-RHOSE-3.1:atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-clients-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-clients-redistributable-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-dockerregistry-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-master-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-pod-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-recycle-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-sdn-ovs-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:tuned-profiles-atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2016:1095" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0" }, "products": [ "7Server-RH7-RHOSE-3.1:atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.src", "7Server-RH7-RHOSE-3.1:atomic-openshift-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-clients-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-clients-redistributable-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-dockerregistry-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-master-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-pod-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-recycle-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:atomic-openshift-sdn-ovs-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64", "7Server-RH7-RHOSE-3.1:tuned-profiles-atomic-openshift-node-0:3.1.1.6-8.git.64.80b61da.el7aos.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "3: Untrusted content loaded via the API proxy can access web console credentials on the same domain" } ] }
ghsa-xhrq-h87x-w62q
Vulnerability from github
Published
2022-05-17 03:54
Modified
2022-05-17 03:54
Severity ?
VLAI Severity ?
Details
Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.
{ "affected": [], "aliases": [ "CVE-2016-3703" ], "database_specific": { "cwe_ids": [ "CWE-284" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2016-06-08T17:59:00Z", "severity": "MODERATE" }, "details": "Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.", "id": "GHSA-xhrq-h87x-w62q", "modified": "2022-05-17T03:54:23Z", "published": "2022-05-17T03:54:23Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3703" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2016:1094" }, { "type": "WEB", "url": "https://access.redhat.com/errata/RHSA-2016:1095" }, { "type": "WEB", "url": "https://access.redhat.com/security/cve/CVE-2016-3703" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1330233" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "type": "CVSS_V3" } ] }
gsd-2016-3703
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2016-3703", "description": "Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.", "id": "GSD-2016-3703", "references": [ "https://access.redhat.com/errata/RHSA-2016:1095", "https://access.redhat.com/errata/RHSA-2016:1094" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2016-3703" ], "details": "Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter.", "id": "GSD-2016-3703", "modified": "2023-12-13T01:21:27.870702Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2016-3703", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_affected": "=", "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "https://access.redhat.com/errata/RHSA-2016:1094", "refsource": "MISC", "url": "https://access.redhat.com/errata/RHSA-2016:1094" }, { "name": "https://access.redhat.com/errata/RHSA-2016:1095", "refsource": "MISC", "url": "https://access.redhat.com/errata/RHSA-2016:1095" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:redhat:openshift:3.1:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:redhat:openshift:3.2:*:*:*:enterprise:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2016-3703" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Red Hat OpenShift Enterprise 3.2 and 3.1 do not properly validate the origin of a request when anonymous access is granted to a service/proxy or pod/proxy API for a specific pod, which allows remote attackers to access API credentials in the web browser localStorage via an access_token in the query parameter." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-284" } ] } ] }, "references": { "reference_data": [ { "name": "RHSA-2016:1095", "refsource": "REDHAT", "tags": [ "Vendor Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2016:1095" }, { "name": "RHSA-2016:1094", "refsource": "REDHAT", "tags": [ "Vendor Advisory" ], "url": "https://access.redhat.com/errata/RHSA-2016:1094" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 3.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "version": "2.0" }, "exploitabilityScore": 6.8, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "LOW", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.0" }, "exploitabilityScore": 1.6, "impactScore": 3.6 } }, "lastModifiedDate": "2023-02-12T23:18Z", "publishedDate": "2016-06-08T17:59Z" } } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…