CVE-2018-1102 — Improper Input Validation in HAT INC Atomic-openshift

CWE-20 — Improper Input ValidationCWE-22 — Path Traversal6 documents5 sources
Severity
8.8HIGHNVD
EPSS
1.6%
top 18.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
RED HAT INC Atomic-openshiftRedhat Openshift
Timeline
PublishedApr 30
Latest updateMay 13

Description

A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶NVDredhat/openshift10 versions+9
▶CVEListV5red_hat_inc/atomic-openshiftas shipped with Openshift Enterprise 3.x

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-x9m6-vq2v-79qg: A flaw was found in source-to-image function as shipped with Openshift Enterprise 3↗2022-05-13
▶
CVEList
CVE-2018-1102: A flaw was found in source-to-image function as shipped with Openshift Enterprise 3↗2018-04-30
▶

📋Vendor Advisories

1
Red Hat
source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go↗2018-04-27
▶

💬Community

2
Bugzilla
CVE-2018-1103 source-to-image: Unsanitized paths in tar.go:ExtractTarStreamFromTarReader() allow malicious containers to overwrite files on the client machine↗2018-04-05
▶
Bugzilla
CVE-2018-1102 source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go↗2018-03-29
▶
CVE-2018-1102 — Improper Input Validation | cvebase