CVE-2014-3496
published 2014-06-20CVE-2014-3496: cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters…
PriorityP357critical10CVSS 2.0
AVNACLAuNCCICAC
EPSS
5.08%
91.4th percentile
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | openshift | — | — |
| redhat | openshift | — | — |
| redhat | openshift | — | — |
| redhat | openshift | — | — |
| redhat | openshift | — | — |
| redhat | openshift | — | — |
| redhat | openshift | — | — |
| redhat | openshift | — | — |
| redhat | openshift | — | — |
| redhat | openshift | — | — |
| redhat | openshift_origin | — | — |
| redhat | openshift_origin | — | — |
| redhat | openshift_origin | — | — |
CVSS provenance
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_redhat10.0CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-9hjx-rfg8-xmx5: cartridge_repository
ghsa_unreviewed·2022-05-13
CVE-2014-3496 [HIGH] CWE-94 GHSA-9hjx-rfg8-xmx5: cartridge_repository
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file.
Red Hat
Origin: Command execution as root via downloadable cartridge source-url
vendor_redhat·2014-06-17·CVSS 10.0
CVE-2014-3496 [CRITICAL] CWE-78 Origin: Command execution as root via downloadable cartridge source-url
Origin: Command execution as root via downloadable cartridge source-url
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file.
No detection rules found.
No public exploits indexed.
http://rhn.redhat.com/errata/RHSA-2014-0762.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0763.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0764.htmlhttp://secunia.com/advisories/59298https://bugzilla.redhat.com/show_bug.cgi?id=1110470https://github.com/openshift/origin-server/pull/5521http://rhn.redhat.com/errata/RHSA-2014-0762.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0763.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0764.htmlhttp://secunia.com/advisories/59298https://bugzilla.redhat.com/show_bug.cgi?id=1110470https://github.com/openshift/origin-server/pull/5521
2014-06-20
Published