A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat Openshift | — | Upgrade rubygem-minitestUpgrade openshift-ansibleUpgrade rubygem-systemd-journalUpgrade rubygem-msgpackUpgrade atomic-openshift-dockerregistryUpgrade rubygem-exconUpgrade apbUpgrade rubygem-tzinfo-dataUpgrade rubygem-faradayUpgrade rubygem-fluent-plugin-kubernetes_metadata_filterUpgrade rubygem-ffiUpgrade rubygem-multi_jsonUpgrade atomic-openshiftUpgrade rubygem-tzinfoUpgrade python-ruamel-yamlUpgrade rubygem-unf_extUpgrade rubygem-fluent-plugin-elasticsearchUpgrade rubygem-cool.ioUpgrade rubygem-fluent-plugin-systemd | Jun 18, 2018 | Apr 27, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub