PT-2018-10244 · Red Hat · Openshift Enterprise

Michael Hanselmann + 1 · Published 2018-04-30 · Updated 2023-02-12 · CVE-2018-1102

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Openshift Enterprise versions 3.x

Description A flaw was found in the source-to-image function, specifically in the improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go, which leads to privilege escalation.

Recommendations For Openshift Enterprise versions 3.x, update the source-to-image function to properly validate tar file paths and prevent privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Path traversal

Weakness Enumeration

CWE-20

CWE-22

Related Identifiers

CVE-2018-1102

RHSA-2018:1227

RHSA-2018:1229

RHSA-2018:1231

RHSA-2018:1233

RHSA-2018:1235

RHSA-2018:1237

RHSA-2018:1239

RHSA-2018:1241

RHSA-2018:1243

RHSA-2019:0036

Affected Products

Openshift Enterprise

References · 13

• https://access.redhat.com/errata/RHSA-2018:1243 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1235 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1102 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1239 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1231 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1229 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1241 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:0036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1102 · Security Note
• https://access.redhat.com/errata/RHSA-2018:1227 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1237 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1562246 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:1233 · Vendor Advisory