Description
A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | atomic-openshift | as shipped with Openshift Enterprise 3.x | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | source-to-image | 1.1.13-1.el7 | RHSA-2019:0036 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | apb +1 | 1.0.6-1.el7 | RHSA-2018:1231 |
| Red Hat OpenShift 3 | atomic-openshift +11 | 3.1.1.11-4.git.3.12809c8.el7 | RHSA-2018:1243, RHSA-2018:1241, RHSA-2018:1239 |
| Red Hat OpenShift 3 | atomic-openshift-service-catalog +2 | 3.6.173.0.113-1.git.0.65fb9fb.el7 | RHSA-2018:1233, RHSA-2018:1231, RHSA-2018:1229 |
| Red Hat OpenShift 3 | atomic-openshift-template-service-broker | 3.7.44-1.git.0.6b061d4.el7 | RHSA-2018:1231, RHSA-2018:1229, RHSA-2018:1227 |
| Red Hat OpenShift 3 | atomic-openshift-tests | 3.2.1.34-2.git.3.aad33c3.el7 | RHSA-2018:1241, RHSA-2018:1239, RHSA-2018:1237 |
| Red Hat OpenShift 3 | openshift-ansible +7 | 3.4.168-1.git.0.bb73aad.el7 | RHSA-2018:1237, RHSA-2018:1235, RHSA-2018:1229 |
| Red Hat OpenShift 3 | python-ruamel-yaml +1 | 0.12.14-9.el7 | RHSA-2018:1237 |
| Red Hat OpenShift 3 | rubygem-cool.io +1 | 1.5.3-1.el7 | RHSA-2018:1233 |
| Red Hat OpenShift 3 | rubygem-excon +1 | 0.60.0-1.el7 | RHSA-2018:1233 |
| Red Hat OpenShift 3 | rubygem-faraday +1 | 0.13.1-1.el7 | RHSA-2018:1233 |
| Red Hat OpenShift 3 | rubygem-ffi | 1.9.23-1.el7 | RHSA-2018:1233 |
| Red Hat OpenShift 3 | rubygem-fluent-plugin-elasticsearch +1 | 1.14.0-1.el7 | RHSA-2018:1231 |
| Red Hat OpenShift 3 | rubygem-fluent-plugin-kubernetes_metadata_filter +1 | 1.0.1-1.el7 | RHSA-2018:1233 |
| Red Hat OpenShift 3 | rubygem-fluent-plugin-systemd +1 | 0.0.9-1.el7 | RHSA-2018:1233 |
| Red Hat OpenShift 3 | rubygem-minitest +1 | 5.10.3-1.el7 | RHSA-2018:1233 |
| Red Hat OpenShift 3 | rubygem-msgpack +1 | 1.2.2-1.el7 | RHSA-2018:1233 |
| Red Hat OpenShift 3 | rubygem-multi_json +1 | 1.13.1-1.el7 | RHSA-2018:1233 |
| Red Hat OpenShift 3 | rubygem-systemd-journal +1 | 1.3.1-1.el7 | RHSA-2018:1233 |
| Red Hat OpenShift 3 | rubygem-tzinfo +1 | 1.2.5-1.el7 | RHSA-2018:1233 |
| Red Hat OpenShift 3 | rubygem-tzinfo-data +1 | 1.2018.3-1.el7 | RHSA-2018:1233 |
| Red Hat OpenShift 3 | rubygem-unf_ext +1 | 0.0.7.5-1.el7 | RHSA-2018:1233 |
Advisories 10
- RHSA-2019:0036 Red Hat Security Advisory: source-to-image security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:1241 Red Hat Security Advisory: OpenShift Container Platform 3.2 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:1243 Red Hat Security Advisory: OpenShift Container Platform 3.1 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:1239 Red Hat Security Advisory: OpenShift Container Platform 3.3 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:1237 Red Hat Security Advisory: OpenShift Container Platform 3.4 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:1235 Red Hat Security Advisory: OpenShift Container Platform 3.5 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:1231 Red Hat Security Advisory: OpenShift Container Platform 3.7 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:1233 Red Hat Security Advisory: OpenShift Container Platform 3.6 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:1227 Red Hat Security Advisory: OpenShift Container Platform 3.9 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2018:1229 Red Hat Security Advisory: OpenShift Container Platform 3.8 security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
References
- RHSA-2018:1235 vendor-advisory
- RHSA-2018:1241 vendor-advisory
- RHSA-2018:1233 vendor-advisory
- RHSA-2019:0036 vendor-advisory
- RHSA-2018:1237 vendor-advisory
- RHSA-2018:1227 vendor-advisory
- RHSA-2018:1243 vendor-advisory
- RHSA-2018:1231 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1562246
- RHSA-2018:1229 vendor-advisory
- RHSA-2018:1239 vendor-advisory