CVE-2016-2142: Infoleak
It was reported that when OpenShift Enterprise 3 is configured to us AD authentication, bind password for AD account is stored in a world readable file:
/etc/origin/master/master-config.yaml
Other sources
Red Hat OpenShift Enterprise 3.1 uses world-readable permissions on the /etc/origin/master/master-config.yaml configuration file, which allows local users to obtain Active Directory credentials by reading the file.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-2142?
CVE-2016-2142 is considered a high severity vulnerability due to its potential to expose sensitive Active Directory credentials.
How do I fix CVE-2016-2142?
To fix CVE-2016-2142, change the permissions on the /etc/origin/master/master-config.yaml file to restrict access to authorized users only.
Who is affected by CVE-2016-2142?
CVE-2016-2142 affects users of Red Hat OpenShift Enterprise version 3.1 that are configured to use Active Directory for authentication.
What type of vulnerability is CVE-2016-2142?
CVE-2016-2142 is a local security vulnerability that allows unauthorized local users to access sensitive information.
What are the consequences of CVE-2016-2142?
The consequences of CVE-2016-2142 include the risk of unauthorized access to Active Directory credentials, potentially leading to further compromise.