CVE-2014-3496
The MITRE CVE dictionary describes this issue as:
cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with a (1) .tar.gz, (2) .zip, (3) .tgz, or (4) .tar file extension in a cartridge manifest file.
Find out more about CVE-2014-3496 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v2 metrics
| Base Score | 10 |
|---|---|
| Base Metrics | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| Access Vector | Network |
| Access Complexity | Low |
| Authentication | None |
| Confidentiality Impact | Complete |
| Integrity Impact | Complete |
| Availability Impact | Complete |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| RHOSE Client 1.2 (rubygem-openshift-origin-node) | RHSA-2014:0762 | 2014-06-18 |
| RHOSE Client 2.0 (rubygem-openshift-origin-node) | RHSA-2014:0764 | 2014-06-18 |
| RHOSE Client 2.0 (rubygem-openshift-origin-node) | RHSA-2014:0763 | 2014-06-18 |
Acknowledgements
This issue was discovered by Jeremy Choi of the Red Hat HSS Pen-test Team.CVE description copyright © 2017, The MITRE Corporation