CVE-2016-2160

First published: Wed Mar 09 2016(Updated: )

It was reported that by creating a new image with root password changed and using it as a sti builder image, attackers are able to gain ROOT in it. Overridding builder image scripts(e.g. assemble) can help the attackers to access the pod and/or perform remote command execution in it. Product bugs (contain reproducer): <a class="bz_bug_link bz_secure " title="" href="show_bug.cgi?id=1315187">https://bugzilla.redhat.com/show_bug.cgi?id=1315187</a> <a class="bz_bug_link bz_secure " title="" href="show_bug.cgi?id=1315188">https://bugzilla.redhat.com/show_bug.cgi?id=1315188</a> Upstream bug: <a href="https://github.com/openshift/origin/pull/7864">https://github.com/openshift/origin/pull/7864</a>

Credit: secalert@redhat.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/type
• agent/first-publish-date
• collector/nvd-index
• agent/software-canonical-lookup-request
• agent/weakness
• agent/severity
• agent/author
• agent/remedy
• agent/references
• agent/softwarecombine
• agent/description
• collector/mitre-cve
• source/MITRE
• agent/last-modified-date
• agent/tags
• agent/event
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2016-2160
• vendor/redhat
• canonical/redhat openshift origin
• canonical/redhat openshift
• version/redhat openshift/3.2