CVE-2016-8651

LOW

OpenShift 3 - Unauthenticated Image Information Disclosure via Manifest Request

Title source: llm
STIX 2.1

Description

An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained within the image.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94935
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2016:2915
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8651

Scores

CVSS v3 3.1
EPSS 0.0135
EPSS Percentile 68.2%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-20
Status published
Products (4)
redhat/openshift 3.0
redhat/openshift_container_platform 3.1
redhat/openshift_container_platform 3.2
redhat/openshift_container_platform 3.3
Published Aug 01, 2018
Tracked Since Feb 18, 2026