PT-2016-5687 · Red Hat+1 · Red Hat Openshift Enterprise+1

Published 2016-06-08 · Updated 2023-02-12 · CVE-2016-3738

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift Enterprise version 3.2

Description The issue is related to improper access restriction to STI builds, allowing remote authenticated users to access the Docker socket and gain privileges. This is achieved through vectors related to build-pod.

Recommendations For Red Hat OpenShift Enterprise version 3.2, consider restricting access to the Docker socket as a temporary workaround until a patch is available. Additionally, review and restrict build-pod related vectors to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-3738

RHSA-2016:1094

Affected Products

Docker

Red Hat Openshift Enterprise

References · 3

• https://access.redhat.com/errata/RHSA-2016:1094 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3738 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3738 · Security Note