Assisted Installer For Red Hat Openshift Container Platform 2
Monthly
Unauthenticated container image tampering in oc-mirror, the mirroring utility shipped with Red Hat OpenShift Container Platform 4 and the Assisted Installer for Red Hat OpenShift Container Platform 2, lets any host on the same adjacent network segment push attacker-controlled images, delete cached images, or read mirrored content while a mirroring operation is running. The embedded local cache registry binds to all network interfaces (0.0.0.0) with neither authentication nor TLS, matching CWE-306, and carries a CVSS 3.1 score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). No public exploit code has been identified at time of analysis, and the exposure window is transient because the vulnerable registry only exists during an active mirroring run.
Arbitrary file write in oc-mirror allows an attacker who controls or tampers with an operator catalog image to write files outside the intended extraction directory when a user mirrors that catalog using the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature). The issue is a path traversal (CWE-22) in tar entry extraction, assessed as local (AV:L), no privileges required (PR:N), but requiring user interaction (UI:R) because an administrator must run the mirror command; impact is high integrity and low availability, with no confidentiality impact per the independent assessment. No public exploit or active exploitation is identified at time of analysis, and the independent assessment characterizes this as a moderate, defender-actionable issue rather than an urgent internet-facing emergency.
Unauthenticated container image tampering in oc-mirror, the mirroring utility shipped with Red Hat OpenShift Container Platform 4 and the Assisted Installer for Red Hat OpenShift Container Platform 2, lets any host on the same adjacent network segment push attacker-controlled images, delete cached images, or read mirrored content while a mirroring operation is running. The embedded local cache registry binds to all network interfaces (0.0.0.0) with neither authentication nor TLS, matching CWE-306, and carries a CVSS 3.1 score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). No public exploit code has been identified at time of analysis, and the exposure window is transient because the vulnerable registry only exists during an active mirroring run.
Arbitrary file write in oc-mirror allows an attacker who controls or tampers with an operator catalog image to write files outside the intended extraction directory when a user mirrors that catalog using the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature). The issue is a path traversal (CWE-22) in tar entry extraction, assessed as local (AV:L), no privileges required (PR:N), but requiring user interaction (UI:R) because an administrator must run the mirror command; impact is high integrity and low availability, with no confidentiality impact per the independent assessment. No public exploit or active exploitation is identified at time of analysis, and the independent assessment characterizes this as a moderate, defender-actionable issue rather than an urgent internet-facing emergency.