CVE-2016-8651
LOWOpenShift 3 - Unauthenticated Image Information Disclosure via Manifest Request
Title source: llmDescription
An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/94935
Third Party Advisory vendor-advisory
x_refsource_redhat
https://access.redhat.com/errata/RHSA-2016:2915
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8651
Scores
CVSS v3
3.1
EPSS
0.0135
EPSS Percentile
68.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Details
CWE
CWE-20
Status
published
Products (4)
redhat/openshift
3.0
redhat/openshift_container_platform
3.1
redhat/openshift_container_platform
3.2
redhat/openshift_container_platform
3.3
Published
Aug 01, 2018
Tracked Since
Feb 18, 2026