Description
source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalation which allows the assemble script to run as the root user in a non-privileged container. An attacker can use this flaw to open network connections, and possibly other actions, on the host which are normally only available to a root user.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | source-to-image | atomic-openshift 3.7.53, atomic-openshift 3.9.31 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-openshift +13 | 3.9.31-1.git.0.ef9737b.el7 | RHSA-2018:2013 |
| Red Hat OpenShift 3 | atomic-openshift-descheduler | 3.9.13-1.git.267.bb59a3f.el7 | RHSA-2018:2013 |
| Red Hat OpenShift 3 | atomic-openshift-dockerregistry | 3.9.31-1.git.351.1bd46ed.el7 | RHSA-2018:2013 |
| Red Hat OpenShift 3 | atomic-openshift-node-problem-detector | 3.9.13-1.git.167.5d6b0d4.el7 | RHSA-2018:2013 |
| Red Hat OpenShift 3 | atomic-openshift-web-console | 3.9.31-1.git.246.bded6a4.el7 | RHSA-2018:2013 |
| Red Hat OpenShift 3 | mysql-apb-role | 1.1.11-1.el7 | RHSA-2018:2013 |
| Red Hat OpenShift 3 | openshift-ansible +4 | 3.9.31-1.git.34.154617d.el7 | RHSA-2018:2013 |
| Red Hat OpenShift 3 | prometheus-node-exporter +1 | 3.9.31-1.git.890.a55de06.el7 | RHSA-2018:2013 |
Advisories 1
- RHSA-2018:2013 Red Hat Security Advisory: OpenShift Container Platform 3.9 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026