CVE-2018-10885 Denial of service in atomic-openshift

What is CVE-2018-10885?

CVE-2018-10885 is a medium-severity denial of service vulnerability in Redhat Openshift, published on 5 Jul 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In atomic-openshift before version 3.10.9 a malicious network-policy configuration can cause Openshift Routing to crash when using ovs-networkpolicy plugin. An attacker can use this flaw to cause a Denial of Service (DoS) attack on an Openshift 3.9, or 3.7 Cluster.

Weakness: CWE-20

Which versions are affected by CVE-2018-10885?

It affects 1 product.

Products include Redhat Openshift.

How do I fix CVE-2018-10885?

No fix has been published for CVE-2018-10885 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2018-10885 being exploited?

There is no known exploitation of CVE-2018-10885 in the wild and no public exploit code.

Other vulnerabilities in Redhat Openshift

• CVE-2014-3496 Command injection in n/a Critical 10.0
• CVE-2014-0234 Hardcoded credentials in Red Hat OpenShift Enterprise Critical 9.8
• CVE-2013-2060 Command injection in OpenShift Origin Critical 9.8
• CVE-2013-4561 Path traversal in openshift-origin-msg-node-mcollective Critical 9.1
• CVE-2014-0163 Command injection in Openshift High 8.8

All Redhat Openshift vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-66vh-fjrh-f335.