CVE-2016-3708
Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespaces, allows remote authenticated users to access network resources on restricted pods via an…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.12%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is enabled and a build is run in a namespace that would normally be isolated from pods in other namespaces, allows remote authenticated users to access network resources on restricted pods via an s2i build with a builder image that (1) contains ONBUILD commands or (2) does not contain a tar binary.
- CVSS 3.0
- 7.1 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
- EPSS
- 1.12% probability · 64th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-284
- Affected
- redhat/openshift
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2016:1094Vendor Advisory
- https://access.redhat.com/errata/RHSA-2016:1094Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.