A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2019:0036 advisory.

  - source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go (CVE-2018-1102)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update is now available for Red Hat OpenShift Container Platform 3.1.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

This advisory contains RPM packages for this release. See the following advisory for the container images for this release :

https://access.redhat.com/errata/RHBA-2018:1242

Security Fix(es) :

* source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go (CVE-2018-1102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1241 advisory.

  - source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go (CVE-2018-1102)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update is now available for Red Hat OpenShift Container Platform 3.3.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Red Hat OpenShift Container Platform is the company's cloud computing Platform-as-a-Service (PaaS) solution designed for on-premise or private cloud deployments.

This advisory contains RPM packages for this release. See the following advisory for the container images for this release :

https://access.redhat.com/errata/RHBA-2018:1238

Security Fix(es) :

* source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go (CVE-2018-1102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1237 advisory.

  - source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go (CVE-2018-1102)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1235 advisory.

  - source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go (CVE-2018-1102)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1233 advisory.

  - source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go (CVE-2018-1102)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1231 advisory.

  - source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go (CVE-2018-1102)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1229 advisory.

  - source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go (CVE-2018-1102)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1227 advisory.

  - source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go (CVE-2018-1102)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194030	RHEL 7 : source-to-image (RHSA-2019:0036)	Nessus	Red Hat Local Security Checks	high
119400	RHEL 7 : OpenShift Container Platform 3.1 (RHSA-2018:1243)	Nessus	Red Hat Local Security Checks	high
119399	RHEL 7 : OpenShift Container Platform 3.2 (RHSA-2018:1241)	Nessus	Red Hat Local Security Checks	high
119398	RHEL 7 : OpenShift Container Platform 3.3 (RHSA-2018:1239)	Nessus	Red Hat Local Security Checks	high
119397	RHEL 7 : OpenShift Container Platform 3.4 (RHSA-2018:1237)	Nessus	Red Hat Local Security Checks	high
119396	RHEL 7 : OpenShift Container Platform 3.5 (RHSA-2018:1235)	Nessus	Red Hat Local Security Checks	high
119395	RHEL 7 : OpenShift Container Platform 3.6 (RHSA-2018:1233)	Nessus	Red Hat Local Security Checks	high
119394	RHEL 7 : OpenShift Container Platform 3.7 (RHSA-2018:1231)	Nessus	Red Hat Local Security Checks	high
119393	RHEL 7 : OpenShift Container Platform 3.8 (RHSA-2018:1229)	Nessus	Red Hat Local Security Checks	high
119392	RHEL 7 : OpenShift Container Platform 3.9 (RHSA-2018:1227)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-1102

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high