The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade jenkins-plugin-pipeline-stage-viewUpgrade nodejs-passportUpgrade nodejs-process-nextick-argsUpgrade jenkins-plugin-blueocean-personalizationUpgrade nodejs-onceUpgrade golang-github-prometheus-node_exporterUpgrade jenkins-plugin-pipeline-model-apiUpgrade nodejs-findup-syncUpgrade python-s3transferUpgrade nodejs-packagingUpgrade jenkins-plugin-openshift-clientUpgrade image-inspectorUpgrade jenkins-plugin-blueocean-jwtUpgrade nodejs-exitUpgrade nodejs-cliuiUpgrade nodejs-generate-object-propertyUpgrade nodejs-concat-streamUpgrade nodejs-longestUpgrade nodejs-parseurlUpgrade golang-github-prometheus-promuUpgrade rubygem-elasticsearch-transportUpgrade nodejs-asapUpgrade jenkins-plugin-blueocean-webUpgrade python-mockUpgrade jenkins-plugin-matrix-projectUpgrade nodejs-center-alignUpgrade jenkins-plugin-mapdb-apiUpgrade jenkins-plugin-pipeline-model-extensionsUpgrade nodejs-asn1Upgrade heapsterUpgrade python-clamdUpgrade nodejs-lodashUpgrade nodejs-amdefineUpgrade nodejs-mime-typesUpgrade rubygem-fluent-plugin-docker_metadata_filterUpgrade rubygem-http-form_dataUpgrade rubygem-elasticsearch-apiUpgrade rubygem-proxifierUpgrade nodejs-eventemitter2Upgrade nodejs-unc-path-regexUpgrade hawkular-openshift-agentUpgrade nodejs-xtendUpgrade nodejs-grunt-contrib-lessUpgrade nodejs-errnoUpgrade nodejs-type-isUpgrade jenkins-plugin-workflow-apiUpgrade nodejs-is-finiteUpgrade nodejs-promiseUpgrade nodejs-indent-stringUpgrade thriftUpgrade rubygem-fluent-plugin-kubernetes_metadata_filterUpgrade rubygem-thread_safeUpgrade jenkins-plugin-openshift-syncUpgrade nodejs-resolveUpgrade nodejs-body-parserUpgrade nodejs-path-to-regexpUpgrade mediawiki-container-scriptsUpgrade jenkins-plugin-openshift-pipelineUpgrade nodejs-varyUpgrade nodejs-keygripUpgrade google-cloud-sdkUpgrade jenkins-plugin-workflow-aggregatorUpgrade nodejs-colorsUpgrade nodejs-strip-ansiUpgrade nodejs-statusesUpgrade nodejs-depdUpgrade nodejs-destroyUpgrade rubygem-fluent-plugin-remote-syslogUpgrade nodejs-esprimaUpgrade jenkins-plugin-docker-commonsUpgrade python-boto3Upgrade runcUpgrade jenkins-plugin-structsUpgrade nodejs-lcidUpgrade nodejs-util-deprecateUpgrade jenkins-plugin-blueocean-git-pipelineUpgrade cri-toolsUpgrade nodejs-pseudomapUpgrade python-dictdifferUpgrade jenkins-plugin-scm-apiUpgrade atomic-openshift-web-consoleUpgrade elasticsearchUpgrade nodejs-bytesUpgrade nodejs-path-is-absoluteUpgrade rubygem-ffiUpgrade jenkins-plugin-authentication-tokensUpgrade nodejs-invert-kvUpgrade python-kubernetesUpgrade nodejs-negotiatorUpgrade nodejs-on-headersUpgrade nodejs-har-validatorUpgrade nodejs-cookie-signatureUpgrade postgresql-apb-roleUpgrade mariadb-apb-roleUpgrade nodejs-http-errorsUpgrade nodejs-aws-sign2Upgrade perl-IO-StringUpgrade nodejs-ctypeUpgrade nodejs-node-uuidUpgrade python-passlibUpgrade jenkins-plugin-blueocean-eventsUpgrade python-ruamel-yamlUpgrade jenkins-plugin-docker-workflowUpgrade jenkins-plugin-blueocean-i18nUpgrade atomic-openshiftUpgrade jenkins-plugin-matrix-authUpgrade nodejs-camelcase-keysUpgrade nodejs-graceful-readlinkUpgrade nodejs-argparseUpgrade apb-base-scriptsUpgrade http-parserUpgrade nodejs-has-ansiUpgrade nodejs-delayed-streamUpgrade nodejs-asyncUpgrade sconsUpgrade nodejs-caselessUpgrade nodejs-array-flattenUpgrade jenkins-plugin-plain-credentialsUpgrade nodejs-extendUpgrade nodejs-kind-ofUpgrade rubygem-tzinfoUpgrade nodejs-tough-cookieUpgrade golang-github-prometheus-prometheusUpgrade nodejs-map-objUpgrade nodejs-ansi-stylesUpgrade jenkins-plugin-pipeline-stage-tags-metadataUpgrade nodejs-is-bufferUpgrade ansible-asb-modulesUpgrade jenkins-plugin-workflow-step-apiUpgrade nodejs-dateformatUpgrade jenkins-plugin-variantUpgrade rubygem-syslog_protocolUpgrade nodejs-commanderUpgrade nodejs-serve-staticUpgrade jenkins-plugin-pipeline-stage-stepUpgrade nodejs-string_decoderUpgrade rubygem-public_suffixUpgrade nodejs-os-localeUpgrade rubygem-sigdumpUpgrade rubygem-addressableUpgrade nodejs-camelcaseUpgrade rubygem-unf_extUpgrade jenkins-plugin-token-macroUpgrade nodejs-right-alignUpgrade python-pyUpgrade python-rsaUpgrade golang-github-openshift-oauth-proxyUpgrade kibanaUpgrade nodejs-etagUpgrade nodejs-patternflyUpgrade nodejs-decamelizeUpgrade rubygem-msgpackUpgrade jenkins-plugin-pubsub-lightUpgrade nodejs-has-flagUpgrade python-httplib2Upgrade mediawiki123Upgrade jenkins-plugin-workflow-scm-stepUpgrade python-string_utilsUpgrade nodejs-abbrevUpgrade rubygem-cool.ioUpgrade jenkins-plugin-blueocean-rest-implUpgrade nodejs-wrappyUpgrade rubygem-multipart-postUpgrade jenkins-plugin-blueocean-display-urlUpgrade jenkins-plugin-kubernetesUpgrade jenkins-plugin-pipeline-graph-analysisUpgrade nodejs-cryptilesUpgrade nodejs-merge-descriptorsUpgrade nodejs-methodsUpgrade jenkins-plugin-blueocean-restUpgrade origin-kibanaUpgrade nodejs-generate-functionUpgrade nodejs-pauseUpgrade cri-oUpgrade nodejs-rimrafUpgrade python-dockerUpgrade nodejs-globUpgrade nodejs-file-sync-cmpUpgrade nodejs-passport-strategyUpgrade jenkins-plugin-multiple-scmsUpgrade rubygem-fluent-plugin-elasticsearchUpgrade jenkins-plugin-git-clientUpgrade rubygem-fluent-plugin-record-modifierUpgrade rubygem-fluent-plugin-secure-forwardUpgrade nodejs-align-textUpgrade jenkins-plugin-junitUpgrade rubygem-fluent-plugin-systemdUpgrade nodejs-hookerUpgrade nodejs-whichUpgrade jenkins-plugin-subversionUpgrade jenkins-plugin-sse-gatewayUpgrade jenkins-plugin-workflow-multibranchUpgrade nodejs-http-signatureUpgrade nodejs-freshUpgrade python-cachetoolsUpgrade nodejs-escape-htmlUpgrade python-libcloudUpgrade openshift-eventrouterUpgrade jenkins-plugin-workflow-remote-loaderUpgrade python-openshiftUpgrade nodejs-isstreamUpgrade nodejs-typedarrayUpgrade rubygem-http_parser.rbUpgrade nodejs-is-unc-pathUpgrade rubygem-httpUpgrade nodejs-image-sizeUpgrade rubygem-mime-typesUpgrade rubygem-http-cookieUpgrade nodejs-js-yamlUpgrade nodejs-meowUpgrade rubygem-i18nUpgrade ansible-service-brokerUpgrade golang-github-openshift-prometheus-alert-bufferUpgrade nodejs-source-mapUpgrade nodejs-debugUpgrade nodejs-jsonpointerUpgrade nodejs-qsUpgrade jenkins-plugin-jackson2-apiUpgrade nodejs-assert-plusUpgrade nodejs-form-dataUpgrade libuvUpgrade nodejs-chalkUpgrade jenkins-plugin-git-serverUpgrade rubygem-tzinfo-dataUpgrade nodejs-sntpUpgrade jenkins-plugin-credentialsUpgrade nodejs-bluebirdUpgrade openshift-ansibleUpgrade nodejs-content-dispositionUpgrade nodejs-expressUpgrade nodejs-on-finishedUpgrade nodejs-content-typeUpgrade rubygem-docker-apiUpgrade containernetworking-pluginsUpgrade nodejs-ee-firstUpgrade python-requests-oauthlibUpgrade openvswitch-ovn-kubernetesUpgrade rubygem-domain_nameUpgrade nodejs-noptUpgrade jenkins-plugin-github-branch-sourceUpgrade nodejs-window-sizeUpgrade jenkins-plugin-pipeline-utility-stepsUpgrade nodejs-acceptsUpgrade nodejs-grunt-legacy-log-utilsUpgrade nodejs-grunt-contrib-cleanUpgrade jenkins-plugin-workflow-basic-stepsUpgrade nodejs-forever-agentUpgrade jenkins-plugin-workflow-cps-global-libUpgrade nodejs-yargsUpgrade jenkins-plugin-blueocean-autofavoriteUpgrade nodejs-eventemitter3Upgrade openshift-elasticsearch-pluginUpgrade nodejs-mimeUpgrade jenkins-plugin-cloudbees-folderUpgrade haproxyUpgrade python-cryptoUpgrade nodejs-passport-oauth2Upgrade nodejs-cookiesUpgrade nodejs-lru-cacheUpgrade jenkins-plugin-githubUpgrade jenkins-plugin-handlebarsUpgrade nodejs-grunt-contrib-copyUpgrade nodejs-graceful-fsUpgrade search-guardUpgrade nodejs-hawkUpgrade rubygem-fluent-plugin-rewrite-tag-filterUpgrade nodejs-minimistUpgrade jenkins-plugin-blueocean-commonsUpgrade python-botocoreUpgrade nodejs-number-is-nanUpgrade rubygem-mime-types-dataUpgrade nodejs-has-colorUpgrade nodejs-hoekUpgrade nodejs-boomUpgrade nodejs-supports-colorUpgrade python-crontabUpgrade elasticsearch-cloud-kubernetesUpgrade jenkins-plugin-workflow-jobUpgrade nodejs-requires-portUpgrade jenkins-2-pluginsUpgrade nodejs-mime-dbUpgrade nodejs-core-util-isUpgrade mediawiki-apb-roleUpgrade nodejs-is-propertyUpgrade python-urllib3Upgrade nodejs-getobjectUpgrade nodejs-y18nUpgrade python-google-authUpgrade jenkins-plugin-pipeline-build-stepUpgrade golang-github-prometheus-alertmanagerUpgrade jenkins-plugin-workflow-cpsUpgrade nodejs-inheritsUpgrade python-clickUpgrade nodejs-is-absoluteUpgrade rubygem-rest-clientUpgrade jenkins-plugin-github-apiUpgrade jenkins-plugin-credentials-bindingUpgrade atomic-openshift-dockerregistryUpgrade nodejs-oauthUpgrade nodejs-repeat-stringUpgrade apbUpgrade rubygem-minitestUpgrade jenkins-plugin-pipeline-milestone-stepUpgrade python-oauthlibUpgrade jenkins-plugin-blueocean-github-pipelineUpgrade rubygem-yajl-rubyUpgrade rubygem-netrcUpgrade jenkins-plugin-blueocean-configUpgrade rubygem-kubeclientUpgrade nodejs-is-relativeUpgrade python-botoUpgrade nodejs-oauth-signUpgrade jenkins-plugin-display-url-apiUpgrade nodejs-base64urlUpgrade python-jwtUpgrade nodejs-sprintf-jsUpgrade nodejs-prrUpgrade nodejs-ansi-regexUpgrade jenkins-plugin-pipeline-input-stepUpgrade jenkins-plugin-pipeline-rest-apiUpgrade nodejs-basic-authUpgrade jenkins-plugin-jquery-detachedUpgrade nodejs-grunt-legacy-logUpgrade jenkins-plugin-gitUpgrade nodejs-grunt-legacy-utilUpgrade nodejs-morganUpgrade v8Upgrade nodejs-minimatchUpgrade openshift-external-storageUpgrade rubygem-multi_jsonUpgrade jenkins-plugin-ace-editorUpgrade jenkins-plugin-mailerUpgrade jenkins-plugin-icon-shimUpgrade nodejs-lessUpgrade nodejs-concat-mapUpgrade nodejs-utils-mergeUpgrade python-pysocksUpgrade rubygem-fluent-plugin-flatten-hashUpgrade nodejs-forwardedUpgrade nodejs-raw-bodyUpgrade rubygem-faradayUpgrade nodejs-wordwrapUpgrade nodejs-grunt-cliUpgrade nodejs-parse-durationUpgrade nodejs-coffee-scriptUpgrade nodejs-proxy-addrUpgrade nodejs-client-sessionsUpgrade fluentdUpgrade jenkins-plugin-blueocean-pipeline-api-implUpgrade nodejs-balanced-matchUpgrade nodejs-url-joinUpgrade python-paramikoUpgrade nodejs-mkdirpUpgrade python-elasticsearchUpgrade openshift-enterprise-image-registryUpgrade rubygem-resolve-hostnameUpgrade jenkins-plugin-blueocean-dashboardUpgrade rubygem-recursive-open-structUpgrade jenkins-plugin-ssh-credentialsUpgrade jenkins-plugin-blueoceanUpgrade python-setuptoolsUpgrade nodejs-yallistUpgrade nodejs-media-typerUpgrade python-ruamel-ordereddictUpgrade rubygem-fluent-plugin-viaq_data_modelUpgrade rubygem-lru_reduxUpgrade nodejs-is-my-json-validUpgrade dumb-initUpgrade nodejs-iconv-liteUpgrade jenkins-plugin-blueocean-pipeline-editorUpgrade nodejs-blUpgrade python-jmespathUpgrade nodejs-readable-streamUpgrade rubygem-string-scrubUpgrade nodejs-combined-streamUpgrade nodejs-object-assignUpgrade rubygem-uuidtoolsUpgrade mysql-apb-roleUpgrade jenkins-plugin-pipeline-model-declarative-agentUpgrade rubygem-exconUpgrade rubygem-elasticsearchUpgrade nodejs-repeatingUpgrade nodejs-ipaddr.jsUpgrade jenkinsUpgrade jenkins-plugin-branch-apiUpgrade nodejs-inflightUpgrade nodejs-passport-http-bearerUpgrade jenkins-plugin-workflow-supportUpgrade jenkins-plugin-durable-taskUpgrade rubygem-fluent-mixin-config-placeholdersUpgrade nodejs-requestUpgrade python-certifiUpgrade jenkins-plugin-workflow-durable-task-stepUpgrade nodejs-tunnel-agentUpgrade jenkins-plugin-mercurialUpgrade nodejs-cookieUpgrade jenkins-plugin-script-securityUpgrade nodejs-unpipeUpgrade nodejs-escape-string-regexpUpgrade nodejs-underscore-dot-stringUpgrade nodejs-range-parserUpgrade jenkins-plugin-pipeline-model-definitionUpgrade rubygem-concurrent-rubyUpgrade nodejs-brace-expansionUpgrade python-keyczarUpgrade nodejsUpgrade nodejs-openshift-auth-proxyUpgrade jenkins-plugin-momentjsUpgrade rubygem-unfUpgrade nodejs-msUpgrade nodejs-is-windowsUpgrade nodejs-http-proxyUpgrade nodejs-sendUpgrade sshpassUpgrade ansible-kubernetes-modulesUpgrade nodejs-stringstreamUpgrade jenkins-plugin-metricsUpgrade python-futuresUpgrade nodejs-uid2Upgrade nodejs-isarrayUpgrade jenkins-plugin-openshift-loginUpgrade jenkins-plugin-favoriteUpgrade nodejs-json-stringify-safeUpgrade cockpitUpgrade python-typingUpgrade rubygem-systemd-journalUpgrade nodejs-gruntUpgrade rubygem-activesupportUpgrade elastic-curatorUpgrade nodejs-finalhandler | Jun 18, 2018 | Mar 28, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub