CVE-2016-7075

It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate.

Score

CVSS 3.0 8.1 High

Status

Modified - secalert@redhat.com

Published

2018-09-10

Last modified

2024-08-06

Weaknesses

CWE-295

Affected products

• Kubernetes (Kubernetes)
• Openshift (Red Hat)
• Openshift (Redhat)

References

• https://access.redhat.com/errata/RHSA-2016:2064
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7075
• https://github.com/kubernetes/kubernetes/issues/34517