CVE-2018-1085 — DEPRECATED: Authentication Bypass Issues in Redhat Openshift Container Platform

CWE-592 — DEPRECATED: Authentication Bypass IssuesCWE-287 — Improper Authentication5 documents5 sources
Severity
9.8CRITICALNVD
CNA9.0
EPSS
1.4%
top 19.53%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Openshift Container Platform
Timeline
PublishedJun 15
Latest updateMay 13

Description

openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCD_CLIENT_CERT_AUTH and ETCD_PEER_CLIENT_CERT_AUTH in etcd.conf result in etcd being configured to allow remote users to connect without any authentication if they can access the etcd server bound to the network on the master nodes. An attacker could use this flaw to read and modify all the data about the Opensh…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-42gw-292w-c96g: openshift-ansible before versions 3↗2022-05-13
▶
CVEList
CVE-2018-1085: openshift-ansible before versions 3↗2018-06-15
▶

📋Vendor Advisories

1
Red Hat
openshift-ansible: Incorrectly quoted values in etcd.conf causes disabling of SSL client certificate authentication↗2018-03-23
▶

💬Community

1
Bugzilla
CVE-2018-1085 openshift-ansible: Incorrectly quoted values in etcd.conf causes disabling of SSL client certificate authentication↗2018-03-19
▶
CVE-2018-1085 — Redhat vulnerability | cvebase