CVE-2017-7517: Input Validation
A user can create a project named "myProject", use that project for a while and then delete it. After the original project is deleted, another user can create a project called "myProject". Since the subjectaccessreview will now pass for this second user, they will be able to access metrics from the original project.
Other sources
An input validation vulnerability exists in Openshift Enterprise due to a 1:1 mapping of tenants in Hawkular Metrics and projects/namespaces in OpenShift. If a user creates a project called "MyProject", and then later deletes it another user can then create a project called "MyProject" and access the metrics stored from the original "MyProject" instance.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7517?
CVE-2017-7517 has been assigned a medium severity rating due to its potential for unauthorized access to metrics by different users.
How do I fix CVE-2017-7517?
To fix CVE-2017-7517, ensure that access controls are properly configured to prevent unauthorized users from accessing metrics after a project is deleted.
Which software is affected by CVE-2017-7517?
CVE-2017-7517 affects Red Hat OpenShift 3.0.
What type of vulnerability is CVE-2017-7517?
CVE-2017-7517 is an access control vulnerability that allows unauthorized access to resources after a project has been deleted.
Can multiple users access the same project name due to CVE-2017-7517?
Yes, CVE-2017-7517 allows different users to create projects with the same name after the original project has been deleted, leading to potential access issues.