Kubernetes in OpenShift3 CVE-2015-7561 Information Disclosure Vulnerability

Bugtraq ID:	100319
Class:	Design Error
CVE:	CVE-2015-7561
Remote:	Yes
Local:	No
Published:	Dec 15 2015 12:00AM
Updated:	Dec 15 2015 12:00AM
Credit:	Miheer Salunke
Vulnerable:	Redhat OpenShift Enterprise 3.0 Kubernetes Kubernetes 0
Not Vulnerable:

Kubernetes in OpenShift3 CVE-2015-7561 Information Disclosure Vulnerability

Kubernetes in OpenShift3 is prone to an information-disclosure vulnerability.

An attacker can exploit this issue to obtain potentially sensitive information. Information obtained may aid in further attacks.

Kubernetes in OpenShift3 CVE-2015-7561 Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Kubernetes in OpenShift3 CVE-2015-7561 Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Kubernetes in OpenShift3 CVE-2015-7561 Information Disclosure Vulnerability

References:

• Kubernetes Homepage (kubernetes)
  
• Add admission controller to force image pulls #18909 (Kubernetes)
  
• Bug 1291963 CVE-2015-7561 OpenShift3: Private Docker images can be used by any u (Redhat)
  
• CVE-2015-7561 (Redhat)