RedHat OpenShift 3.0 Enterprise Edition

A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.

Published: 2018-04-30T19:00:00.000Z
Updated: 2024-08-05T03:51:49.044Z

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.

Published: 2018-04-24T18:00:00.000Z
Updated: 2024-09-17T00:46:47.514Z

A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.

Published: 2018-07-13T22:00:00.000Z
Updated: 2024-08-05T07:46:47.518Z

OpenShift Enterprise version 3.x is vulnerable to a stored XSS via the log viewer for pods. The flaw is due to lack of sanitation of user input, specifically terminal escape characters, and the creation of clickable links automatically when viewing the log files for a pod.

Published: 2018-04-11T19:00:00.000Z
Updated: 2024-08-05T16:04:11.828Z

An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespaces in OpenShift. If a user creates a project called "MyProject", and then later deletes it another user can then create a project called "MyProject" and access the metrics stored from the original "MyProject" instance.

Published: 2022-10-17T00:00:00.000Z
Updated: 2025-05-13T20:43:30.312Z