6.5
Moyenne
CVE-2017-12195 A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin
Description
A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the Elasticsearch be configured with an external route, and the data accessed is limited to the indices.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| OpenShift | Versions non publiées |
Autres CVE de OpenShift
Les 7 CVE de OpenShift →
CVE-2019-19355
An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk
7.0
Élevée
CVE-2019-19351
An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins
7.0
Élevée
CVE-2019-10213
OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level…
5.3
Moyenne
CVE-2019-14845
A vulnerability was found in OpenShift builds, versions 4.1 up to 4.3
5.7
Moyenne