CVE-2016-8651: Input Validation
An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.
Other sources
It is reported that given the manifest data for a container that is not owned by a user that user will still be able to pull the container and access the contents of it.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8651?
CVE-2016-8651 is classified as a medium severity vulnerability due to its potential for information disclosure.
How do I fix CVE-2016-8651?
To fix CVE-2016-8651, you should upgrade to the latest version of OpenShift that addresses this vulnerability.
What effect does CVE-2016-8651 have on OpenShift users?
CVE-2016-8651 allows unauthorized users to pull sensitive images, leading to possible information disclosure.
Which versions of OpenShift are affected by CVE-2016-8651?
CVE-2016-8651 affects OpenShift versions 3.0, 3.1, 3.2, and 3.3.
Can CVE-2016-8651 be exploited remotely?
Yes, CVE-2016-8651 can be exploited remotely by users who have access to the image manifest.