CVE-2012-5647: Input Validation
Michael Scherer (mscherer) reports:
the file https://github.com/openshift/origin-server/blob/master/node-util/www/html/restorer.php used to restore application after being idle fails to safely handle user supplied data that is later used in the HTTP headers for the Location: value which can then result in request redirection to an arbitrary page.
Other sources
Open redirect vulnerability in node-util/www/html/restorer.php in Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the PATHINFO.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5647?
CVE-2012-5647 has a medium severity rating due to its potential to compromise application integrity.
How do I fix CVE-2012-5647?
To fix CVE-2012-5647, upgrade to the latest patched version of Red Hat OpenShift or OpenShift Origin.
What software is affected by CVE-2012-5647?
CVE-2012-5647 affects Red Hat OpenShift 1.0 and Red Hat OpenShift Origin up to version 1.0.5.
What issue does CVE-2012-5647 address?
CVE-2012-5647 addresses a vulnerability in the restoration process of applications after being idle.
Is there a workaround for CVE-2012-5647?
Currently, the recommended solution for CVE-2012-5647 is to upgrade the affected software as no workaround is advised.