CVE-2016-9592: Medium severity red hat openshift vulnerability

Published Apr 16, 2018

Updated

openshift before versions 3.3.1.11, 3.2.1.23, 3.4 is vulnerable to a flaw when a volume fails to detach, which causes the delete operation to fail with 'VolumeInUse' error. Since the delete operation is retried every 30 seconds for each volume, this could lead to a denial of service attack as the number of API requests being sent to the cloud-provider exceeds the API's rate-limit.

Affected Software

3 affected components

redhat Openshift=3.2.1.23

redhat Openshift=3.3.1.11

redhat Openshift=3.4

Event History

Apr 16, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2016-9592?

CVE-2016-9592 is classified as a high severity vulnerability due to its potential to cause denial of service.

How do I fix CVE-2016-9592?

To mitigate CVE-2016-9592, upgrade OpenShift to versions 3.3.1.12, 3.2.1.24, or ensure you are using 3.4 or later.

What types of systems are affected by CVE-2016-9592?

CVE-2016-9592 affects Red Hat OpenShift versions 3.2.1.23, 3.3.1.11, and 3.4.

What exploitation vector exists for CVE-2016-9592?

CVE-2016-9592 can be exploited when the volume fails to detach, resulting in a prolonged 'VolumeInUse' error and resource exhaustion.

Is a workaround available for CVE-2016-9592?

There is no specific official workaround for CVE-2016-9592; upgrading to the patched versions is recommended.