VulnerabilityModified
CVE-2016-8651
A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.
LOW 3.5EPSS 1.35%
Does this matter?
Lower severity and a low EPSS score (1.35%). Track it; it rarely justifies an emergency change on its own.
Description
An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.
- CVSS 3.0
- 3.5 LOWCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 1.35% probability · 70th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- redhat/openshift · redhat/openshift container platform
- Source
- secalert@redhat.com
References
- http://www.securityfocus.com/bid/94935Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2016:2915Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8651Issue Tracking, Third Party Advisory
- http://www.securityfocus.com/bid/94935Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2016:2915Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8651Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.