Bug 1356195 (CVE-2016-5392)

Summary:	CVE-2016-5392 Kubernetes: disclosure of information in multi tenant environments via watch-cache list
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bleanhar, ccoleman, dmcphers, jialiu, jokerman, lmeyer, mmccomas, security-response-team, tdawson, yanpzhan
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	The Kubernetes API server contains a watch cache that speeds up performance. Due to an input validation error OpenShift Enterprise may return data for other users and projects when queried by a user. An attacker with knowledge of other project names could use this vulnerability to view their information.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 00:53:45 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1355715, 1355915
Bug Blocks:	1356225

Description Kurt Seifried 2016-07-13 15:47:14 UTC

Yanping Zhang of Red Hat reports:

It is possible for one user to view another users data due to the kubernetes watch cache delivering the wrong data in a multi tenant environment.

Comment 1 Kurt Seifried 2016-07-13 15:47:22 UTC

Acknowledgments:

Name: Yanping Zhang (Red Hat)

Comment 2 Yanping Zhang 2016-07-14 08:13:44 UTC

This issue has been fixed according to bug 1355915

Comment 3 errata-xmlrpc 2016-07-14 15:57:14 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Enterprise 3.2

Via RHSA-2016:1427 https://access.redhat.com/errata/RHSA-2016:1427