CVE-2016-5392 Information disclosure in n/a

Medium 6.5 Published 5 Aug 2016 Updated 6 Aug 2024

Authenticated users can access sensitive project and user information in multi-tenant Kubernetes environments due to watch-cache flaws.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-5392?

CVE-2016-5392 is a medium-severity vulnerability in Redhat Openshift, published on 5 Aug 2016. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive project and user information via vectors related to the watch-cache list.

Weakness: CWE-200

Which versions are affected by CVE-2016-5392?

It affects 1 product.

Linux distribution packages (11)

`atomic-openshift` Red Hat:openshift:3.2::el7	All versions	`0:3.2.1.7-1.git.0.2702170.el7`
`atomic-openshift-clients` Red Hat:openshift:3.2::el7	All versions	`0:3.2.1.7-1.git.0.2702170.el7`
`atomic-openshift-clients-redistributable` Red Hat:openshift:3.2::el7	All versions	`0:3.2.1.7-1.git.0.2702170.el7`
`atomic-openshift-dockerregistry` Red Hat:openshift:3.2::el7	All versions	`0:3.2.1.7-1.git.0.2702170.el7`
`atomic-openshift-master` Red Hat:openshift:3.2::el7	All versions	`0:3.2.1.7-1.git.0.2702170.el7`
`atomic-openshift-node` Red Hat:openshift:3.2::el7	All versions	`0:3.2.1.7-1.git.0.2702170.el7`
`atomic-openshift-pod` Red Hat:openshift:3.2::el7	All versions	`0:3.2.1.7-1.git.0.2702170.el7`
`atomic-openshift-recycle` Red Hat:openshift:3.2::el7	All versions	`0:3.2.1.7-1.git.0.2702170.el7`
`atomic-openshift-sdn-ovs` Red Hat:openshift:3.2::el7	All versions	`0:3.2.1.7-1.git.0.2702170.el7`
`atomic-openshift-tests` Red Hat:openshift:3.2::el7	All versions	`0:3.2.1.7-1.git.0.2702170.el7`
`tuned-profiles-atomic-openshift-node` Red Hat:openshift:3.2::el7	All versions	`0:3.2.1.7-1.git.0.2702170.el7`

Products include Redhat Openshift.

How do I fix CVE-2016-5392?

Apply the vendor's patch.

Is CVE-2016-5392 being exploited?

There is no known exploitation of CVE-2016-5392 in the wild and no public exploit code.

All Redhat Openshift vulnerabilities

Sources

Also known as RHSA-2016:1427.