PT-2018-12628 · Red Hat · Openshift Container Platform

Jason Shepherd + 1 · Published 2018-09-06 · Updated 2023-02-07 · CVE-2018-14632

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenShift Container Platform versions prior to 3.7

Description The issue is related to an out-of-bounds write that can occur when patching an OpenShift object using the oc patch functionality. This can be exploited to cause a denial of service attack on the OpenShift master API service, which provides cluster management. A malicious JSON patch can cause a panic due to an out-of-bounds write attempt, potentially serving as a denial of service vector if exposed to arbitrary user input.

Recommendations For OpenShift Container Platform versions prior to 3.7, update to version 3.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the oc patch functionality to minimize the risk of exploitation. Avoid using the oc patch command with untrusted input until the issue is resolved.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2018-14632

GHSA-GXHV-3HWF-WJP9

GO-2021-0076

RHSA-2018:2654

RHSA-2018:2709

RHSA-2018:2906

RHSA-2018:2908

Affected Products

Openshift Container Platform

References · 18

• https://github.com/evanphx/json-patch/commit/4c9aadca8f89e349c999f04e28199e96e81aba03#diff-65c563bba473be9d94ce4d033f74810e · Patch
• https://access.redhat.com/errata/RHSA-2018:2908 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gxhv-3hwf-wjp9 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2018:2652 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2021-0076 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14632 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2906 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2654 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:2709 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-14632 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-14632 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-14632 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14632 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-14632 · Vendor Advisory
• https://github.com/evanphx/json-patch/commit/4c9aadca8f89e349c999f04e28199e96e81aba03 · Note