VulnerabilityModified

CVE-2018-1103

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input.

MEDIUM 6.5EPSS 1.34%

Does this matter?

Lower severity and a low EPSS score (1.34%). Track it; it rarely justifies an emergency change on its own.

Description

Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command.

CVSS 3.0: 6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS: 1.34% probability · 70th percentile
CISA KEV: Not listed
Weakness: CWE-22, CWE-20
Affected: redhat/source-to-image
Source: secalert@redhat.com

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1103Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1103Issue Tracking

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.