PT-2014-3526 · Red Hat · Red Hat Openshift Enterprise

Published 2014-04-24 · Updated 2023-02-13 · CVE-2014-0188

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift Enterprise versions 2.0.5, 1.2.7 and earlier

Description The issue allows remote attackers to bypass authentication and impersonate arbitrary users via the X-Remote-User header in a request to a passthrough trigger, due to improper handling of authentication requests from the remote-user auth plugin.

Recommendations For Red Hat OpenShift Enterprise versions 2.0.5, 1.2.7 and earlier, consider restricting access to the passthrough trigger to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-0188

RHSA-2014:0422

RHSA-2014:0423

Affected Products

Red Hat Openshift Enterprise

References · 4

• https://bugzilla.redhat.com/show_bug.cgi?id=1090120 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-0422.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-0188 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-0423.html · Vendor Advisory