CVE-2015-8945 openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive priv...
MediumCVSS 5.1
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive private key information by reading the systemd journal.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openshift github.com/openshift/origin | <= 1.1.6 | No fix listed |
References
- [oss-security] 20160713 Re: CVE Request: openshift-node is logging private RSA keys to the systemd journal mailing-list vdb-entry
- [oss-security] 20160713 CVE Request: openshift-node is logging private RSA keys to the systemd journal mailing-list vdb-entry
- 91776 third-party-advisory vdb-entry
- github.com patch