CVE-2014-0233
published 2014-11-16CVE-2014-0233: Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a…
PriorityP336medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EPSS
1.73%
75.3th percentile
Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | openshift | — | — |
| redhat | openshift | — | — |
CVSS provenance
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-frgq-r6cx-mg8w: Red Hat OpenShift Enterprise 2
ghsa_unreviewed·2022-05-13
CVE-2014-0233 [MEDIUM] CWE-94 GHSA-frgq-r6cx-mg8w: Red Hat OpenShift Enterprise 2
Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme.
Red Hat
OpenShift: downloadable cartridge source url file command execution as root
vendor_redhat·2014-05-21·CVSS 6.5
CVE-2014-0233 [MEDIUM] CWE-73 OpenShift: downloadable cartridge source url file command execution as root
OpenShift: downloadable cartridge source url file command execution as root
Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme.
Package: rubygem-openshift-origin-node (OpenShift Enterprise 1) - Affected
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-0233 OpenShift: downloadable cartridge source url file command execution as root
bugzilla·2014-05-12·CVSS 6.5
CVE-2014-0233 [MEDIUM] CVE-2014-0233 OpenShift: downloadable cartridge source url file command execution as root
CVE-2014-0233 OpenShift: downloadable cartridge source url file command execution as root
Jeremy Choi of Red Hat reports:
Attackers, with normal user privilege, are able to do OS command injection
with *root* by leveraging a downloadable cartridge where its source-URL
scheme is 'file'.
In cartridge_repository.rb:
532 when 'file' == uri.scheme
533 entries = Dir.glob(PathUtils.join(uri.path, '*'), File::FNM_DO TMATCH)
534 filesystem_copy(entries, target, %w(. ..))
...
609 Utils.oo_spawn("/bin/cp -ad #{entries.join(' ')} #{target}",
610 expected_exitstatus: 0)
OpenShift Origin copies the directory structure from the user specified
cartridge when an application is created via 'file' scheme source. Due to
this attackers are able to add an arbitrary directory with system commands
(e.g. ;reb
Bugzilla
CVE-2014-0071 OpenStack PackStack: Neutron Security Groups fail to block network traffic
bugzilla·2014-02-12·CVSS 6.4
CVE-2014-0071 [MEDIUM] CVE-2014-0071 OpenStack PackStack: Neutron Security Groups fail to block network traffic
CVE-2014-0071 OpenStack PackStack: Neutron Security Groups fail to block network traffic
Yair Fried of Red Hat reports:
A regression from Grizzly and Havana exists in the PackStack rules deployed to Neutron. Specifically when default security groups are enabled they are not
enforced, allowing connectivity to systems that should be blocked by the security
groups.
External references:
https://review.openstack.org/#/c/62702/
Discussion:
This issue has been addressed in following products:
OpenStack 4 for RHEL 6
Via RHSA-2014:0233 https://rhn.redhat.com/errata/RHSA-2014-0233.html
---
Statement:
(none)
2014-11-16
Published