Buffer overflow in Starcounter-Jack Json-Patch
CVE-2018-14632
An out of bound write can occur when patching an Openshift object using the 'oc patch' functionality in OpenShift Container Platform before 3.7. An attacker can use this flaw to cause a denial of service attack on the Openshift master api service which provides cluster management.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.019 (79.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 79th percentile — 79.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.020 · newest: 0.019 · change: -0.000
Affected products
- Starcounter-Jack Json-Patch
- Red Hat Atomic-Openshift — versions atomic-openshift-3.7
- Red Hat Openshift Container Platform — versions 3.9, 3.10, 3.11
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi (Patch, Issue Tracking, Vendor Advisory)
- github.com/evanphx/json-patch/commit/4c9aadca8f89e349c999f04e28199e96e81aba03 (Patch, Third Party Advisory)
- access.redhat.com/errata/RHBA-2018:2652 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2018:2654 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2018:2908 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2018:2906 (vendor-advisory, Vendor Advisory)
- access.redhat.com/errata/RHSA-2018:2709 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-14632?
- CVE-2018-14632 is a high-severity vulnerability in Starcounter-Jack Json-Patch, classified under Out-of-bounds Write. CVSS score: 7.7/10. Published 2018-09-06.
- How severe is CVE-2018-14632?
- High severity. CVSS v3 base score is 7.7 out of 10.