Bug 1390735 – CVE-2016-8631 OSE 3: Router sometimes selects new routes over old routes when determining claimed hostnames

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1390735 - (CVE-2016-8631) CVE-2016-8631 OSE 3: Router sometimes selects new routes over old routes when determining claimed hostnames

Summary:	CVE-2016-8631 OSE 3: Router sometimes selects new routes over old routes when...

Status:	CLOSED ERRATA

Aliases:	CVE-2016-8631

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20161101,repor...
Keywords:	Security

Depends On:	1387428
Blocks:	1388808
	Show dependency tree / graph

Reported:	2016-11-01 14:53 EDT by Kurt Seifried
Modified:	2016-11-15 20:05 EST (History)
CC List:	13 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-11-15 20:05:24 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2016:2696	normal	SHIPPED_LIVE	Moderate: atomic-openshift security and bug fix update	2016-11-15 18:29:31 EST

Groups: None (edit)

Description Kurt Seifried 2016-11-01 14:53:47 EDT

Jordan Liggitt of Red Hat reports:

The OpenShift Enterprise 3 router sometimes selects new routes over old routes 
when determining claimed hostnames. This can result in a new route improperly 
overwriting an older route.

Comment 1 Kurt Seifried 2016-11-01 14:54:01 EDT

Acknowledgments:

Name: Jordan Liggitt (Red Hat)

Comment 2 errata-xmlrpc 2016-11-15 13:30:56 EST

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.3

Via RHSA-2016:2696 https://access.redhat.com/errata/RHSA-2016:2696

Note You need to log in before you can comment on or make changes to this bug.