CVE-2014-0233 Command injection in n/a

What is CVE-2014-0233?

CVE-2014-0233 is a medium-severity command injection vulnerability in Redhat Openshift, published on 16 Nov 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Red Hat OpenShift Enterprise 2.0 and 2.1 and OpenShift Origin allow remote authenticated users to execute arbitrary commands via shell metacharacters in a directory name that is referenced by a cartridge using the file: URI scheme.

Weakness: CWE-94

Which versions are affected by CVE-2014-0233?

It affects 1 product.

Products include Redhat Openshift.

How do I fix CVE-2014-0233?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2014-0233 being exploited?

There is no known exploitation of CVE-2014-0233 in the wild and no public exploit code.

Other vulnerabilities in Redhat Openshift

• CVE-2014-3496 Command injection in n/a Critical 10.0
• CVE-2014-0234 Hardcoded credentials in Red Hat OpenShift Enterprise Critical 9.8
• CVE-2013-2060 Command injection in OpenShift Origin Critical 9.8
• CVE-2013-4561 Path traversal in openshift-origin-msg-node-mcollective Critical 9.1
• CVE-2014-0163 Command injection in Openshift High 8.8

All Redhat Openshift vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-frgq-r6cx-mg8w, RHSA-2014:0529, RHSA-2014:0530.