CVE-2013-2060 Command injection in OpenShift Origin

What is CVE-2013-2060?

CVE-2013-2060 is a critical command injection vulnerability in Redhat Openshift, published on 28 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The download_from_url function in OpenShift Origin allows remote attackers to execute arbitrary commands via shell metacharacters in the URL of a request to download a cart.

Weakness: CWE-78

Which versions are affected by CVE-2013-2060?

It affects 1 product.

Products include Redhat Openshift.

How do I fix CVE-2013-2060?

No fix has been published for CVE-2013-2060 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2013-2060 being exploited?

There is no known exploitation of CVE-2013-2060 in the wild and no public exploit code.

Other vulnerabilities in Redhat Openshift

• CVE-2014-3496 Command injection in n/a Critical 10.0
• CVE-2014-0234 Hardcoded credentials in Red Hat OpenShift Enterprise Critical 9.8
• CVE-2013-4561 Path traversal in openshift-origin-msg-node-mcollective Critical 9.1
• CVE-2014-0163 Command injection in Openshift High 8.8
• CVE-2018-1102 Path traversal in atomic-openshift High 8.8

All Redhat Openshift vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j52h-5vxc-vjgw.