Red Hat Security AdvisoryRHSA-2016:0351
kubernetes security update
Released 2016-03-03 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat OpenShift Enterprise 3.0 openshift-3.0.2.0-0.git.45.423f434.el7ose, openshift-clients-3.0.2.0-0.git.45.423f434.el7ose, openshift-master-3.0.2.0-0.git.45.423f434.el7ose +3
Fixes 2 records
Priority MEDIUM 50
Openshift allows remote attackers to gain privileges by updating a build configuration that was created with an allowed type to a type that is not allowed.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.04843 · Published 2016-02-03 · Partial fix · 1.1.1 CWE-264
Priority LOW 37
The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object.
CVSS 3.0HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.01583 · Published 2016-02-03 · Partial fix · 1.2.0-alpha.6 CWE-284
