Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2018-14632

An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before 3.7. An attacker can use this flaw to cause a denial of service attack on the Openshift master api service which provides cluster management.

Published

2018-09-06T14:29:00.587

Last Modified

2024-11-21T03:49:28.047

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.7 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

2.9

Weaknesses

Type: Secondary
CWE-787
Type: Primary
CWE-787

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	redhat	openshift_container_platform	≤ 3.7	Yes
Application	redhat	openshift_container_platform	3.9	Yes
Application	redhat	openshift_container_platform	3.10	Yes
Application	redhat	openshift_container_platform	3.11	Yes
Application	starcounter-jack	json-patch	-	Yes

References

https://access.redhat.com/errata/RHBA-2018:2652 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:2654 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:2709 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:2906 Vendor Advisory ([email protected])
https://access.redhat.com/errata/RHSA-2018:2908 Vendor Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14632 Issue Tracking, Patch, Vendor Advisory ([email protected])
https://github.com/evanphx/json-patch/commit/4c9aadca8f89e349c999f04e28199e96e81aba03#diff-65c563bba473be9d94ce4d033f74810e Patch, Third Party Advisory ([email protected])
https://access.redhat.com/errata/RHBA-2018:2652 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2654 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2709 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2906 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2018:2908 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14632 Issue Tracking, Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/evanphx/json-patch/commit/4c9aadca8f89e349c999f04e28199e96e81aba03#diff-65c563bba473be9d94ce4d033f74810e Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)