CVE-2012-5658: Low severity red hat openshift vulnerability
It is reported that the rhc-chk command when run with the -d displays the password in cleartext.
Other sources
rhc-chk.rb in Red Hat OpenShift Origin before 1.1, when -d (debug mode) is used, outputs the password and other sensitive information in cleartext, which allows context-dependent attackers to obtain sensitive information, as demonstrated by including log files or Bugzilla reports in support channels.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-5658?
CVE-2012-5658 has been classified as a moderate severity vulnerability.
How do I fix CVE-2012-5658?
To fix CVE-2012-5658, upgrade to Red Hat OpenShift Origin version 1.1 or later where the issue has been resolved.
What are the risks associated with CVE-2012-5658?
The risks associated with CVE-2012-5658 include the exposure of sensitive information such as passwords to context-dependent attackers.
Which versions of Red Hat OpenShift are affected by CVE-2012-5658?
CVE-2012-5658 affects Red Hat OpenShift versions prior to 1.1 and specifically version 1.0.5 of OpenShift Origin.
Is there a workaround for CVE-2012-5658 if I cannot upgrade immediately?
A workaround for CVE-2012-5658 is to avoid using the -d (debug) option when running the rhc-chk command.