PT-2015-6842 · Red Hat+2 · Red Hat Openshift Enterprise+2

Jordan Liggitt · Published 2015-11-06 · Updated 2023-02-13 · CVE-2015-5305

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Kubernetes versions prior to the fixed version Red Hat OpenShift Enterprise version 3.0

Description A directory traversal issue exists due to improper handling of crafted object type names before they are passed to etcd. This allows attackers to write to arbitrary files, exploiting the vulnerability. The issue arises from the lack of validation of object names.

Recommendations For Kubernetes versions prior to the fixed version, consider restricting access to etcd to minimize the risk of exploitation. For Red Hat OpenShift Enterprise version 3.0, update to a version that includes the fix for this issue. As a temporary workaround, consider validating object type names before passing them to etcd to prevent directory traversal attacks.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2015-5305

GHSA-JP32-VMM6-3VF5

GO-2022-0701

RHSA-2015:1945

Affected Products

Kubernetes

Red Hat Openshift Enterprise

Etcd

References · 13

• https://osv.dev/vulnerability/GHSA-jp32-vmm6-3vf5 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0701 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2015:1945 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1273969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5305 · Security Note
• https://github.com/kubernetes/kubernetes · Note
• https://github.com/kubernetes/kubernetes/commit/37f730f68c7f06e060f90714439bfb0dbb2df5e7 · Note
• https://github.com/kubernetes/kubernetes/pull/16381 · Note
• https://github.com/kubernetes/kubernetes/commit/68f2add9bd5d43b9da1424d87d88f83d120e17d0 · Note
• https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5305 · Note
• https://access.redhat.com/security/cve/CVE-2015-5305 · Note
• https://t.me/cvenotify/44181 · Telegram Post
• https://pkg.go.dev/vuln/GO-2022-0701 · Note