rhsa-2016_1094
Vulnerability from csaf_redhat
Published
2016-05-19 20:12
Modified
2024-09-15 23:26
Summary
Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.2 security update

Notes

Topic
An update for atomic-openshift and nodejs-node-uuid is now available for Red Hat OpenShift Enterprise 3.2. In addition, all images have been rebuilt on the new RHEL 7.2.4 base image. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
OpenShift Enterprise by Red Hat is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments. Security Fix(es): * A vulnerability was found in the STI build process in OpenShift Enterprise. Access to STI builds was not properly restricted, allowing an attacker to use STI builds to access the Docker socket and escalate their privileges. (CVE-2016-3738) * An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser's localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized access_token was provided in the query parameter. (CVE-2016-3703) * A flaw was found in OpenShift Enterprise when multi-tenant SDN is enabled and a build is run within a namespace that would normally be isolated from pods in other namespaces. If an s2i build is run in such an environment the container being built can access network resources on pods that should not be available to it. (CVE-2016-3708) The CVE-2016-3738 issue was discovered by David Eads (Red Hat); the CVE-2016-3703 issue was discovered by Jordan Liggitt (Red Hat); and the CVE-2016-3708 issue was discovered by Ben Parees (Red Hat). This update includes the following images: openshift3/ose:v3.2.0.44-2 openshift3/ose-deployer:v3.2.0.44-2 openshift3/ose-docker-builder:v3.2.0.44-2 openshift3/ose-docker-registry:v3.2.0.44-2 openshift3/ose-f5-router:v3.2.0.44-2 openshift3/ose-haproxy-router:v3.2.0.44-2 openshift3/ose-keepalived-ipfailover:v3.2.0.44-2 openshift3/ose-pod:v3.2.0.44-2 openshift3/ose-recycler:v3.2.0.44-2 openshift3/ose-sti-builder:v3.2.0.44-2 openshift3/jenkins-1-rhel7:1.642-32 openshift3/logging-auth-proxy:3.2.0-4 openshift3/logging-deployment:3.2.0-9 openshift3/logging-elasticsearch:3.2.0-8 openshift3/logging-fluentd:3.2.0-8 openshift3/logging-kibana:3.2.0-4 openshift3/metrics-deployer:3.2.0-6 openshift3/metrics-heapster:3.2.0-6 openshift3/mongodb-24-rhel7:2.4-28 openshift3/mysql-55-rhel7:5.5-26 openshift3/nodejs-010-rhel7:0.10-35 openshift3/node:v3.2.0.44-2 openshift3/openvswitch:v3.2.0.44-2 openshift3/perl-516-rhel7:5.16-38 openshift3/php-55-rhel7:5.5-35 openshift3/postgresql-92-rhel7:9.2-25 openshift3/python-33-rhel7:3.3-35 openshift3/ruby-20-rhel7:2.0-35 aep3_beta/aep:v3.2.0.44-2 aep3_beta/aep-deployer:v3.2.0.44-2 aep3_beta/aep-docker-registry:v3.2.0.44-2 aep3_beta/aep-f5-router:v3.2.0.44-2 aep3_beta/aep-haproxy-router:v3.2.0.44-2 aep3_beta/aep-keepalived-ipfailover:v3.2.0.44-2 aep3_beta/aep-pod:v3.2.0.44-2 aep3_beta/aep-recycler:v3.2.0.44-2 aep3_beta/logging-auth-proxy:3.2.0-4 aep3_beta/logging-deployment:3.2.0-9 aep3_beta/logging-elasticsearch:3.2.0-8 aep3_beta/logging-fluentd:3.2.0-8 aep3_beta/logging-kibana:3.2.0-4 aep3_beta/metrics-deployer:3.2.0-6 aep3_beta/metrics-heapster:3.2.0-6 aep3_beta/node:v3.2.0.44-2 aep3_beta/openvswitch:v3.2.0.44-2
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for atomic-openshift and nodejs-node-uuid is now available for Red Hat OpenShift Enterprise 3.2. In addition, all images have been rebuilt on the new RHEL 7.2.4 base image.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenShift Enterprise by Red Hat is the company\u0027s cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.\n\nSecurity Fix(es):\n\n* A vulnerability was found in the STI build process in OpenShift Enterprise. Access to STI builds was not properly restricted, allowing an attacker to use STI builds to access the Docker socket and escalate their privileges. (CVE-2016-3738)\n\n* An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser\u0027s localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized access_token was provided in the query parameter. (CVE-2016-3703)\n\n* A flaw was found in OpenShift Enterprise when multi-tenant SDN is enabled and a build is run within a namespace that would normally be isolated from pods in other namespaces. If an s2i build is run in such an environment the container being built can access network resources on pods that should not be available to it. (CVE-2016-3708)\n\nThe CVE-2016-3738 issue was discovered by David Eads (Red Hat); the CVE-2016-3703 issue was discovered by Jordan Liggitt (Red Hat); and the CVE-2016-3708 issue was discovered by Ben Parees (Red Hat).\n\nThis update includes the following images:\n\nopenshift3/ose:v3.2.0.44-2\nopenshift3/ose-deployer:v3.2.0.44-2\nopenshift3/ose-docker-builder:v3.2.0.44-2\nopenshift3/ose-docker-registry:v3.2.0.44-2\nopenshift3/ose-f5-router:v3.2.0.44-2\nopenshift3/ose-haproxy-router:v3.2.0.44-2\nopenshift3/ose-keepalived-ipfailover:v3.2.0.44-2\nopenshift3/ose-pod:v3.2.0.44-2\nopenshift3/ose-recycler:v3.2.0.44-2\nopenshift3/ose-sti-builder:v3.2.0.44-2\nopenshift3/jenkins-1-rhel7:1.642-32\nopenshift3/logging-auth-proxy:3.2.0-4\nopenshift3/logging-deployment:3.2.0-9\nopenshift3/logging-elasticsearch:3.2.0-8\nopenshift3/logging-fluentd:3.2.0-8\nopenshift3/logging-kibana:3.2.0-4\nopenshift3/metrics-deployer:3.2.0-6\nopenshift3/metrics-heapster:3.2.0-6\nopenshift3/mongodb-24-rhel7:2.4-28\nopenshift3/mysql-55-rhel7:5.5-26\nopenshift3/nodejs-010-rhel7:0.10-35\nopenshift3/node:v3.2.0.44-2\nopenshift3/openvswitch:v3.2.0.44-2\nopenshift3/perl-516-rhel7:5.16-38\nopenshift3/php-55-rhel7:5.5-35\nopenshift3/postgresql-92-rhel7:9.2-25\nopenshift3/python-33-rhel7:3.3-35\nopenshift3/ruby-20-rhel7:2.0-35\n\naep3_beta/aep:v3.2.0.44-2\naep3_beta/aep-deployer:v3.2.0.44-2\naep3_beta/aep-docker-registry:v3.2.0.44-2\naep3_beta/aep-f5-router:v3.2.0.44-2\naep3_beta/aep-haproxy-router:v3.2.0.44-2\naep3_beta/aep-keepalived-ipfailover:v3.2.0.44-2\naep3_beta/aep-pod:v3.2.0.44-2\naep3_beta/aep-recycler:v3.2.0.44-2\naep3_beta/logging-auth-proxy:3.2.0-4\naep3_beta/logging-deployment:3.2.0-9\naep3_beta/logging-elasticsearch:3.2.0-8\naep3_beta/logging-fluentd:3.2.0-8\naep3_beta/logging-kibana:3.2.0-4\naep3_beta/metrics-deployer:3.2.0-6\naep3_beta/metrics-heapster:3.2.0-6\naep3_beta/node:v3.2.0.44-2\naep3_beta/openvswitch:v3.2.0.44-2",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2016:1094",
        "url": "https://access.redhat.com/errata/RHSA-2016:1094"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1306011",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1306011"
      },
      {
        "category": "external",
        "summary": "1318974",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1318974"
      },
      {
        "category": "external",
        "summary": "1324996",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1324996"
      },
      {
        "category": "external",
        "summary": "1329044",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1329044"
      },
      {
        "category": "external",
        "summary": "1330233",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1330233"
      },
      {
        "category": "external",
        "summary": "1330364",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1330364"
      },
      {
        "category": "external",
        "summary": "1331229",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1331229"
      },
      {
        "category": "external",
        "summary": "1333168",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333168"
      },
      {
        "category": "external",
        "summary": "1333461",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333461"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2016/rhsa-2016_1094.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat OpenShift Enterprise 3.2 security update",
    "tracking": {
      "current_release_date": "2024-09-15T23:26:31+00:00",
      "generator": {
        "date": "2024-09-15T23:26:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.33.3"
        }
      },
      "id": "RHSA-2016:1094",
      "initial_release_date": "2016-05-19T20:12:26+00:00",
      "revision_history": [
        {
          "date": "2016-05-19T20:12:26+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2016-05-19T20:12:27+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-09-15T23:26:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 3.2",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 3.2",
                  "product_id": "7Server-RH7-RHOSE-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:3.2::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-node-uuid-0:1.4.7-1.el7.noarch",
                "product": {
                  "name": "nodejs-node-uuid-0:1.4.7-1.el7.noarch",
                  "product_id": "nodejs-node-uuid-0:1.4.7-1.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-node-uuid@1.4.7-1.el7?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "nodejs-node-uuid-0:1.4.7-1.el7.src",
                "product": {
                  "name": "nodejs-node-uuid-0:1.4.7-1.el7.src",
                  "product_id": "nodejs-node-uuid-0:1.4.7-1.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/nodejs-node-uuid@1.4.7-1.el7?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
                "product": {
                  "name": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
                  "product_id": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/atomic-openshift@3.2.0.44-1.git.0.a4463d9.el7?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                "product": {
                  "name": "atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_id": "atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/atomic-openshift-node@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                "product": {
                  "name": "atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_id": "atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/atomic-openshift-master@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                "product": {
                  "name": "atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_id": "atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/atomic-openshift-recycle@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                "product": {
                  "name": "atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_id": "atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/atomic-openshift-clients-redistributable@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                "product": {
                  "name": "atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_id": "atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/atomic-openshift-dockerregistry@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                "product": {
                  "name": "atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_id": "atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/atomic-openshift-clients@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                "product": {
                  "name": "atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_id": "atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/atomic-openshift-pod@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                "product": {
                  "name": "tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_id": "tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/tuned-profiles-atomic-openshift-node@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                "product": {
                  "name": "atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_id": "atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/atomic-openshift-tests@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                "product": {
                  "name": "atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_id": "atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/atomic-openshift-sdn-ovs@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                "product": {
                  "name": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_id": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/atomic-openshift@3.2.0.44-1.git.0.a4463d9.el7?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src"
        },
        "product_reference": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        },
        "product_reference": "atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        },
        "product_reference": "atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        },
        "product_reference": "atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        },
        "product_reference": "atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        },
        "product_reference": "atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        },
        "product_reference": "atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        },
        "product_reference": "atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        },
        "product_reference": "atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        },
        "product_reference": "atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        },
        "product_reference": "atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-node-uuid-0:1.4.7-1.el7.noarch as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch"
        },
        "product_reference": "nodejs-node-uuid-0:1.4.7-1.el7.noarch",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "nodejs-node-uuid-0:1.4.7-1.el7.src as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src"
        },
        "product_reference": "nodejs-node-uuid-0:1.4.7-1.el7.src",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.2",
          "product_id": "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        },
        "product_reference": "tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Jordan Liggitt"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2016-3703",
      "cwe": {
        "id": "CWE-285",
        "name": "Improper Authorization"
      },
      "discovery_date": "2016-04-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1330233"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An origin validation vulnerability was found in OpenShift Enterprise. An attacker could potentially access API credentials stored in a web browser\u0027s localStorage if anonymous access was granted to a service/proxy or pod/proxy API for a specific pod, and an authorized access_token was provided in the query parameter.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "3: Untrusted content loaded via the API proxy can access web console credentials on the same domain",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch",
          "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src",
          "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-3703"
        },
        {
          "category": "external",
          "summary": "RHBZ#1330233",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1330233"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-3703",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-3703"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3703",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3703"
        }
      ],
      "release_date": "2016-05-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch",
            "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src",
            "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1094"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch",
            "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src",
            "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "3: Untrusted content loaded via the API proxy can access web console credentials on the same domain"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ben Parees"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2016-3708",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2016-04-27T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1331229"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenShift Enterprise when multi-tenant SDN is enabled and a build is run within a namespace that would normally be isolated from pods in other namespaces. If an s2i build is run in such an environment the container being built can access network resources on pods that should not be available to it.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "3: s2i builds implicitly perform docker builds",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch",
          "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src",
          "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-3708"
        },
        {
          "category": "external",
          "summary": "RHBZ#1331229",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1331229"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-3708",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-3708"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3708",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3708"
        }
      ],
      "release_date": "2016-04-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch",
            "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src",
            "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1094"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.9,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch",
            "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src",
            "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "3: s2i builds implicitly perform docker builds"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "David Eads"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2016-3738",
      "cwe": {
        "id": "CWE-284",
        "name": "Improper Access Control"
      },
      "discovery_date": "2016-05-04T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1333461"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in the STI build process in OpenShift Enterprise. Access to STI builds was not properly restricted, allowing an attacker to use STI builds to access the Docker socket and escalate their privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "origin: pod update allows docker socket access via build-pod",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
          "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch",
          "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src",
          "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2016-3738"
        },
        {
          "category": "external",
          "summary": "RHBZ#1333461",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1333461"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2016-3738",
          "url": "https://www.cve.org/CVERecord?id=CVE-2016-3738"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-3738",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-3738"
        }
      ],
      "release_date": "2016-05-19T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch",
            "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src",
            "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2016:1094"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.src",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-clients-redistributable-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-dockerregistry-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-master-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-pod-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-recycle-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-sdn-ovs-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:atomic-openshift-tests-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64",
            "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.noarch",
            "7Server-RH7-RHOSE-3.2:nodejs-node-uuid-0:1.4.7-1.el7.src",
            "7Server-RH7-RHOSE-3.2:tuned-profiles-atomic-openshift-node-0:3.2.0.44-1.git.0.a4463d9.el7.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "origin: pod update allows docker socket access via build-pod"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.