CVE-2018-14632

An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before 3.7. An attacker can use this flaw to cause a denial of service attack on the Openshift master api service which provides cluster management.

Score

CVSS 3.1 7.7 High

Status

Modified - secalert@redhat.com

Published

2018-09-06

Last modified

2024-08-05

Weaknesses

CWE-787

Affected products

• Atomic-openshift (Red Hat)
• Openshift Container Platform (Redhat)
• Json-patch (Starcounter-jack)

References

• https://access.redhat.com/errata/RHBA-2018:2652
• https://access.redhat.com/errata/RHSA-2018:2654
• https://access.redhat.com/errata/RHSA-2018:2709
• https://access.redhat.com/errata/RHSA-2018:2906
• https://access.redhat.com/errata/RHSA-2018:2908
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14632
• https://github.com/evanphx/json-patch/commit/4c9aadca8f89e349c999f04e28199e96e81aba03#diff-65c563bba473be9d94ce4d033f74…