Bug 1390735 (CVE-2016-8631) - CVE-2016-8631 OSE 3: Router sometimes selects new routes over old routes when determining claimed hostnames
Summary: CVE-2016-8631 OSE 3: Router sometimes selects new routes over old routes when...
Status: CLOSED ERRATA
Alias: CVE-2016-8631
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20161101,repor...
Keywords: Security
Depends On: 1387428
Blocks: 1388808
TreeView+ depends on / blocked
 
Reported: 2016-11-01 18:53 UTC by Kurt Seifried
Modified: 2016-11-16 01:05 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
The OpenShift Enterprise 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-11-16 01:05:24 UTC
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2696 normal SHIPPED_LIVE Moderate: atomic-openshift security and bug fix update 2016-11-15 23:29:31 UTC

Description Kurt Seifried 2016-11-01 18:53:47 UTC
Jordan Liggitt of Red Hat reports:

The OpenShift Enterprise 3 router sometimes selects new routes over old routes 
when determining claimed hostnames. This can result in a new route improperly 
overwriting an older route.

Comment 1 Kurt Seifried 2016-11-01 18:54:01 UTC
Acknowledgments:

Name: Jordan Liggitt (Red Hat)

Comment 2 errata-xmlrpc 2016-11-15 18:30:56 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.3

Via RHSA-2016:2696 https://access.redhat.com/errata/RHSA-2016:2696


Note You need to log in before you can comment on or make changes to this bug.