PT-2018-4981 · Linux Foundation+1 · Kubernetes+1

Liggitt · Publicado 2018-09-10 · Atualizado 2023-02-12 · CVE-2016-7075

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Openshift Enterprise 3

Description A flaw was found in the validation of X.509 client intermediate certificate host name fields in Kubernetes as used by Openshift Enterprise. This could allow an attacker to bypass authentication requirements using a specially crafted X.509 certificate.

Recommendations For Openshift Enterprise 3, update the Kubernetes component to correctly validate X.509 client intermediate certificate host name fields. As a temporary workaround, consider restricting access to sensitive resources that rely on X.509 certificate authentication until a patch is available.

Exploit

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

CVE-2016-7075

RHSA-2016:2064

Produtos afetados

Kubernetes

Openshift Enterprise

Referências · 10

• 🔥 https://github.com/kubernetes/kubernetes/issues/34517 · Exploit
• https://cve.org/CVERecord?id=CVE-2016-7075 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-7075 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-7075 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-7075 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2016-7075 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-7075 · Nota de Segurança
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7075 · Nota
• https://access.redhat.com/errata/RHSA-2016:2064 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-7075 · Aviso do Fabricante