Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-8651

An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.

Published

2018-08-01T16:29:00.273

Last Modified

2024-11-21T02:59:46.030

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 3.1 (LOW)

CVSSv2 Vector

AV:A/AC:L/Au:S/C:P/I:N/A:N

Access Vector: ADJACENT_NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

5.1

Impact Score

2.9

Weaknesses

Type: Primary
CWE-20
Type: Secondary
CWE-20

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	redhat	openshift	3.0	Yes
Application	redhat	openshift_container_platform	3.1	Yes
Application	redhat	openshift_container_platform	3.2	Yes
Application	redhat	openshift_container_platform	3.3	Yes

References

http://www.securityfocus.com/bid/94935 Third Party Advisory, VDB Entry ([email protected])
https://access.redhat.com/errata/RHSA-2016:2915 Third Party Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8651 Issue Tracking, Third Party Advisory ([email protected])
http://www.securityfocus.com/bid/94935 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2016:2915 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8651 Issue Tracking, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)