Vulnerability Details : CVE-2018-14632
An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before 3.7. An attacker can use this flaw to cause a denial of service attack on the Openshift master api service which provides cluster management.
Vulnerability category: Memory CorruptionDenial of service
Products affected by CVE-2018-14632
- cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_container_platform:3.9:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_container_platform:3.10:*:*:*:*:*:*:*
- cpe:2.3:a:starcounter-jack:json-patch:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2018-14632
0.17%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 53 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2018-14632
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:P |
8.0
|
2.9
|
NIST | |
|
7.7
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
3.1
|
4.0
|
Red Hat, Inc. | |
|
7.7
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H |
3.1
|
4.0
|
NIST |
CWE ids for CVE-2018-14632
-
The product writes data past the end, or before the beginning, of the intended buffer.Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)
References for CVE-2018-14632
-
https://github.com/evanphx/json-patch/commit/4c9aadca8f89e349c999f04e28199e96e81aba03#diff-65c563bba473be9d94ce4d033f74810e
fix check idx index · evanphx/json-patch@4c9aadc · GitHubPatch;Third Party Advisory
-
https://access.redhat.com/errata/RHSA-2018:2906
RHSA-2018:2906 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14632
1625885 – (CVE-2018-14632) CVE-2018-14632 atomic-openshift: oc patch with json causes masterapi service crashIssue Tracking;Patch;Vendor Advisory
-
https://access.redhat.com/errata/RHSA-2018:2908
RHSA-2018:2908 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://access.redhat.com/errata/RHSA-2018:2709
RHSA-2018:2709 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://access.redhat.com/errata/RHSA-2018:2654
RHSA-2018:2654 - Security Advisory - Red Hat Customer PortalVendor Advisory
-
https://access.redhat.com/errata/RHBA-2018:2652
RHBA-2018:2652 - Bug Fix Advisory - Red Hat Customer PortalVendor Advisory
Jump to