Description
It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | OpenShift | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.5.5+dfsg-1 | — |
| Debian 13 | kubernetes | 1.5.5+dfsg-1 | — |
| Debian 12 | kubernetes | 1.5.5+dfsg-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +9 | 3.1.1.8-1.git.0.d469026.el7aos | RHSA-2016:2064 |
| Red Hat OpenShift 3 | atomic-openshift-tests | 3.2.1.17-1.git.0.6d01b60.el7 | RHSA-2016:2064 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubernetes-1.34 +3 | No fix yet | — |
Advisories 1
- RHSA-2016:2064 Red Hat Security Advisory: atomic-openshift security update Red Hat Security Advisories (RHSA) · Jul 1, 2026