CVE-2018-1069
First published: Thu Mar 08 2018(Updated: )
GlusterFS and NFS network filesystems rely on File System User ID and Group ID information in order to restrict access to file shares. However it's possible to overwrite the Openshift restrictions on container UserId and GroupdId as they are not validated before being sent over the Openshift Networking. An attacker could use the flaw to read and write any data on the network filesystem.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat OpenShift | =3.7 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1346466
- https://github.com/gluster/gluster-kubernetes/blob/master/docs/design/tls-security.md
- https://docs.openshift.com/container-platform/3.7/admin_guide/managing_networking.html#admin-guide-controlling-egress-traffic
- https://docs.openshift.com/container-platform/3.7/admin_guide/managing_networking.html#enabling-static-ips-for-external-project-traffic
- https://docs.openshift.org/latest/admin_guide/managing_networking.html#admin-guide-deploying-an-egress-router-pod
- https://bugzilla.redhat.com/show_bug.cgi?id=1552987
- http://www.securityfocus.com/bid/103364
Frequently Asked Questions
What is the severity of CVE-2018-1069?
CVE-2018-1069 has been classified with a medium severity level due to its potential impact on file share access controls.
How do I fix CVE-2018-1069?
To fix CVE-2018-1069, you should update to the latest patched version of Red Hat OpenShift that addresses this vulnerability.
What systems are affected by CVE-2018-1069?
CVE-2018-1069 affects Red Hat OpenShift version 3.7, specifically related to GlusterFS and NFS filesystems.
What are the implications of CVE-2018-1069?
The implications of CVE-2018-1069 include the risk of unauthorized access to file shares due to the failure to validate user IDs and group IDs.
Is there a workaround for CVE-2018-1069?
While the primary recommendation is to apply the update, additional security measures such as restricting network access may serve as a temporary workaround for CVE-2018-1069.
- agent/type
- agent/weakness
- agent/first-publish-date
- agent/severity
- agent/author
- agent/references
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-1069
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/redhat
- canonical/red hat openshift
- version/red hat openshift/3.7