CVE-2016-2142 Information disclosure in n/a

Medium 5.5 Published 8 Jun 2016 Updated 5 Aug 2024

Local users can read world-readable configuration files to steal Active Directory credentials in Red Hat OpenShift Enterprise.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2016-2142?

CVE-2016-2142 is a medium-severity vulnerability in Redhat Openshift, published on 8 Jun 2016. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Red Hat OpenShift Enterprise 3.1 uses world-readable permissions on the /etc/origin/master/master-config.yaml configuration file, which allows local users to obtain Active Directory credentials by reading the file.

Weakness: CWE-200

Which versions are affected by CVE-2016-2142?

It affects 1 product.

Linux distribution packages (10)

`atomic-openshift` Red Hat:openshift:3.1::el7	All versions	`0:3.1.1.6-6.git.43.f583589.el7aos`
`atomic-openshift-clients` Red Hat:openshift:3.1::el7	All versions	`0:3.1.1.6-6.git.43.f583589.el7aos`
`atomic-openshift-clients-redistributable` Red Hat:openshift:3.1::el7	All versions	`0:3.1.1.6-6.git.43.f583589.el7aos`
`atomic-openshift-dockerregistry` Red Hat:openshift:3.1::el7	All versions	`0:3.1.1.6-6.git.43.f583589.el7aos`
`atomic-openshift-master` Red Hat:openshift:3.1::el7	All versions	`0:3.1.1.6-6.git.43.f583589.el7aos`
`atomic-openshift-node` Red Hat:openshift:3.1::el7	All versions	`0:3.1.1.6-6.git.43.f583589.el7aos`
`atomic-openshift-pod` Red Hat:openshift:3.1::el7	All versions	`0:3.1.1.6-6.git.43.f583589.el7aos`
`atomic-openshift-recycle` Red Hat:openshift:3.1::el7	All versions	`0:3.1.1.6-6.git.43.f583589.el7aos`
`atomic-openshift-sdn-ovs` Red Hat:openshift:3.1::el7	All versions	`0:3.1.1.6-6.git.43.f583589.el7aos`
`tuned-profiles-atomic-openshift-node` Red Hat:openshift:3.1::el7	All versions	`0:3.1.1.6-6.git.43.f583589.el7aos`

Products include Redhat Openshift.

How do I fix CVE-2016-2142?

Apply the vendor's patch.

Is CVE-2016-2142 being exploited?

There is no known exploitation of CVE-2016-2142 in the wild and no public exploit code.

All Redhat Openshift vulnerabilities

Sources

Also known as GHSA-8qr6-wfrg-m44g, RHSA-2016:1038.