Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2017-15137

Опубликовано: 28 мар. 2018
Источник: redhat
CVSS3: 4.3
EPSS Низкий

Описание

The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat OpenShift Container Platform 3.10atomic-openshiftNot affected
Red Hat OpenShift Container Platform 3.7atomic-openshiftAffected
Red Hat OpenShift Container Platform 3.9ansible-asb-modulesFixedRHBA-2018:048928.03.2018
Red Hat OpenShift Container Platform 3.9ansible-kubernetes-modulesFixedRHBA-2018:048928.03.2018
Red Hat OpenShift Container Platform 3.9ansible-service-brokerFixedRHBA-2018:048928.03.2018
Red Hat OpenShift Container Platform 3.9apbFixedRHBA-2018:048928.03.2018
Red Hat OpenShift Container Platform 3.9apb-base-scriptsFixedRHBA-2018:048928.03.2018
Red Hat OpenShift Container Platform 3.9atomic-openshiftFixedRHBA-2018:048928.03.2018
Red Hat OpenShift Container Platform 3.9atomic-openshift-dockerregistryFixedRHBA-2018:048928.03.2018
Red Hat OpenShift Container Platform 3.9atomic-openshift-web-consoleFixedRHBA-2018:048928.03.2018

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-20
https://bugzilla.redhat.com/show_bug.cgi?id=1566191atomic-openshift: image import whitelist can be bypassed by creating an imagestream or using oc tag

EPSS

Процентиль: 38%
0.00167
Низкий

4.3 Medium

CVSS3

Связанные уязвимости

CVSS3: 4.3
nvd
больше 7 лет назад

The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed.

CVSS3: 5.3
github
больше 3 лет назад

The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed.

EPSS

Процентиль: 38%
0.00167
Низкий

4.3 Medium

CVSS3

Уязвимость CVE-2017-15137