Flaw in kubernetes allows privilege escalation and allow access to sensitive information
As per RedHat flaw has been detected in kubernetes which allows privilege escalation and access to sensitive information in OpenShift products and services.
- Issue - CVE-2018-1002105
- security impact is Critical.
- Critical Security Advisory and patches for CVE-2018-1002105 is Released.
- To Resolve please refer to Advisory and Updates.
- Note - All Kubernetes-based services and products - including Red Hat OpenShift Container Platform, Red Hat OpenShift Online, and Red Hat OpenShift Dedicated - are affected.
- "All 3.x versions of OpenShift Container Platform allow for compromise of pods (multiple running container instances) running on a compute node to which a pod is scheduled with normal user privilege. This access could include access to all secrets, pods, environment variables, running pod/container processes, and persistent volumes."
- "OpenShift Container Platform versions 3.6 and higher, this vulnerability allows cluster-admin level access to any API hosted by an aggregated API server. "
- "OpenShift Dedicated environments, a regular user, with pod exec/attach/portforward permissions, can gain cluster-level administrative privileges on any compute node that can run that pod. This includes exec access to all running workloads, all current secrets, logs, etc.. "
- "RedHat Upstream acknowledges Darren Shepherd as the original reporter"
- RedHat Youtube Video
- The following Red Hat Product versions are impacted:
Red Hat OpenShift Container Platform 3.x
Red Hat OpenShift Online
Red Hat OpenShift Dedicated
- To check the version of OpenShift container platform installed send an http request to the API server, such as (Note: The URL should be the same as the webconsole URL):
curl https://openshift.example.com/version/openshift | grep gitVersion
- From ‘oc’ command you can check the version with this command: oc version
- Any versions of OpenShift Container Platform older than those listed below are vulnerable: