CVE-2018-1085— Red Hat openshift-ansible 安全漏洞

N/A

openshift-ansible before versions 3.9.23, 3.7.46 deploys a misconfigured etcd file that causes the SSL client certificate authentication to be disabled. Quotations around the values of ETCD_CLIENT_CERT_AUTH and ETCD_PEER_CLIENT_CERT_AUTH in etcd.conf result in etcd being configured to allow remote users to connect without any authentication if they can access the etcd server bound to the network on the master nodes. An attacker could use this flaw to read and modify all the data about the Openshift cluster in the etcd datastore, potentially adding another compute node, or bringing down the entire cluster.

N/A

CWE-592

Red Hat openshift-ansible 安全漏洞

Red Hat OpenShift是美国红帽（Red Hat）公司的一款平台即服务（PaaS）云计算平台，它可构建、测试、部署和运行应用程序。openshift-ansible是其中的一个用于安装、升级和管理OpenShift的工具。 Red Hat openshift-ansible 3.9.23之前版本和3.7.46之前版本中存在安全漏洞，该漏洞源于程序部署了错误配置的etcd文件。攻击者可利用该漏洞读取并更改在etcd数据储存库中有关Openshift集群的数据并可能添加其他的计算节点。

N/A

N/A