CVE-2014-0084 openshift-origin-node Improper Input Validation vulnerability

Medium 5.5 Published 21 Nov 2019 Updated 6 Aug 2024

Missing cronjob timeout in the OpenShift Origin Node Ruby gem allows attackers to cause a denial of service in daily and weekly cron jobs.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2014-0084?

CVE-2014-0084 is a medium-severity denial of service vulnerability in rubygem-openshift-origin-node, published on 21 Nov 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Ruby gem openshift-origin-node before 2014-02-14 does not contain a cronjob timeout which could result in a denial of service in cron.daily and cron.weekly.

Weakness: CWE-20

Which versions are affected by CVE-2014-0084?

2 open source packages ship an affected version, including openshift-origin-node. It affects 1 product.

Package	Affected	Fixed in
`openshift-origin-node` RubyGems	All versions to `1.3.3`	None
`openshift-origin-node` RubyGems	All versions to `1.3.3`	None

Products include Redhat Openshift Origin.

How do I fix CVE-2014-0084?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2014-0084 being exploited?

There is no known exploitation of CVE-2014-0084 in the wild and no public exploit code.

Sources

Also known as GHSA-756m-3qf2-hp58.