PT-2018-10136 · Red Hat · Openshift Container Platform

Sam Fowler · Published 2018-07-02 · Updated 2019-10-09 · CVE-2018-10843

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Openshift Container Platform versions prior to atomic-openshift 3.7.53 Openshift Container Platform versions prior to atomic-openshift 3.9.31

Description The issue allows for privilege escalation, enabling the assemble script to run as the root user in a non-privileged container. This could allow an attacker to open network connections and possibly perform other actions on the host that are normally only available to a root user.

Recommendations For versions prior to atomic-openshift 3.7.53, update to atomic-openshift 3.7.53 or later. For versions prior to atomic-openshift 3.9.31, update to atomic-openshift 3.9.31 or later.

Fix

Incorrect Permission

RCE

Weakness Enumeration

CWE-732

CWE-20

Related Identifiers

CVE-2018-10843

RHSA-2018:2013

Affected Products

Openshift Container Platform

References · 4

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10843 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-10843 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10843 · Security Note
• https://access.redhat.com/errata/RHSA-2018:2013 · Vendor Advisory