CVE-2017-15137: The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example

Medium severity · published Jul 16, 2018

CVE-2017-15137

The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example

5.3

CVSS

EPSS

On KEV

Description

The OpenShift image import whitelist failed to enforce restrictions correctly when running commands such as "oc tag", for example. This could allow a user with access to OpenShift to run images from registries that should not be allowed.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

Low

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.0% · higher than 62% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Openshift · Redhat

All versions, or not specified · source: NVD

Openshift Container Platform · Redhat

3.9 · source: NVD

Affected product

Openshift

Redhat

All Openshift CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2017-15137

CVE.org

https://www.cve.org/CVERecord?id=CVE-2017-15137

Vendor Advisory

https://access.redhat.com/errata/RHBA-2018:0489

Issue Tracking

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15137