Bug 1390735 (CVE-2016-8631) - CVE-2016-8631 OSE 3: Router sometimes selects new routes over old routes when determining claimed hostnames
Summary: CVE-2016-8631 OSE 3: Router sometimes selects new routes over old routes when...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-8631
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1387428
Blocks: 1388808
TreeView+ depends on / blocked
 
Reported: 2016-11-01 18:53 UTC by Kurt Seifried
Modified: 2021-02-17 03:05 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site.
Clone Of:
Environment:
Last Closed: 2016-11-16 01:05:24 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2696 0 normal SHIPPED_LIVE Moderate: atomic-openshift security and bug fix update 2016-11-15 23:29:31 UTC

Description Kurt Seifried 2016-11-01 18:53:47 UTC 
Jordan Liggitt of Red Hat reports:

The OpenShift Enterprise 3 router sometimes selects new routes over old routes 
when determining claimed hostnames. This can result in a new route improperly 
overwriting an older route.
Comment 1 Kurt Seifried 2016-11-01 18:54:01 UTC 
Acknowledgments:

Name: Jordan Liggitt (Red Hat)
Comment 2 errata-xmlrpc 2016-11-15 18:30:56 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.3

Via RHSA-2016:2696 https://access.redhat.com/errata/RHSA-2016:2696
Note You need to log in before you can comment on or make changes to this bug.