low3.1
CVE-2015-7561
Kubernetes in OpenShift3 Access Control Misconfiguration
Impact
Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | k8s.io/kubernetes | < 1.2.0-alpha.6 | 1.2.0-alpha.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Kubernetes | Kubernetes | All versions |
| Redhat | Openshift | Version 3.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1291963
- https://github.com/kubernetes/kubernetes/pull/18909
- https://github.com/advisories/GHSA-2h9c-34v6-3qmr
- https://nvd.nist.gov/vuln/detail/CVE-2015-7561
- https://github.com/kubernetes/kubernetes/commit/e185b1028ac8459f7b451e1115399192e96f6ee9