Bug 1579096 (CVE-2018-10843)
| Summary: | CVE-2018-10843 source-to-image: Builder images with assembler-user LABEL set to root allows attackers to execute arbitrary code | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Sam Fowler <sfowler> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | abhgupta, adam.kaplan, ahardin, bleanhar, ccoleman, dbaker, dedgar, dominik.mierzejewski, hhorak, jechoi, jgoulding, jokerman, jorton, mchappel, security-response-team, sthangav, thrcka, trankin |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | atomic-openshift 3.7.53, atomic-openshift 3.9.31 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A privilege escalation flaw was found in the source-to-image component of Openshift Container Platform which allows the assemble script to run as the root user in a non-privileged container. An attacker can use this flaw to open network connections, and possibly other actions, on the host which are normally only available to a root user.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-10 10:23:11 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1582976, 1582977, 1583421 | ||
| Bug Blocks: | 1579098 | ||
|
Description
Sam Fowler
2018-05-17 00:22:38 UTC
Acknowledgments: Name: Jeremy Choi (Red Hat) This issue has been addressed in the following products: Red Hat OpenShift Container Platform 3.9 Via RHSA-2018:2013 https://access.redhat.com/errata/RHSA-2018:2013 RHSCL release was packaged before io.openshift.s2i.assemble-user functionality was added to source-to-image. |