VulnerabilityModified

CVE-2016-3711

HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID" cookie.

LOW 3.3EPSS 0.36%

Does this matter?

Lower severity and a low EPSS score (0.36%). Track it; it rarely justifies an emergency change on its own.

Description

HAproxy in Red Hat OpenShift Enterprise 3.2 and OpenShift Origin allows local users to obtain the internal IP address of a pod by reading the "OPENSHIFT_[namespace]_SERVERID" cookie.

CVSS 3.0: 3.3 LOWCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS: 0.36% probability · 29th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: redhat/openshift · redhat/openshift origin
Source: secalert@redhat.com

References

https://access.redhat.com/errata/RHSA-2016:1064Vendor Advisory
https://github.com/openshift/origin/pull/8334Patch
https://access.redhat.com/errata/RHSA-2016:1064Vendor Advisory
https://github.com/openshift/origin/pull/8334Patch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.