CVE-2017-12195: red hat openshift Improper Authentication

CVSS: 6.5v3.0MediumModified

AliasesRHSA-2017:3188RHSA-2017:3389

Published 27-07-2018Last modified 05-08-2024

Vulnerability summary

CVE-2017-12195 is a medium (CVSS 6.5) Improper Authentication vulnerability in red hat openshift. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 71.9% of scored vulnerabilities.

Overall risk

26/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.5/10

010

Medium · v3.0 (CVE.org)

EPSS score

1.39%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

27-07-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin. An attacker with knowledge of the given name used to authenticate and access Elasticsearch can later access it without the token, bypassing authentication. This attack also requires that the Elasticsearch be configured with an external route, and the data accessed is limited to the indices.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.06.5v2.05.8

EPSS trend

Probability

1.39%

Chance of exploitation in the next 30 days

Percentile

72%

Versus all other CVEs

30-day change

0.00 pp

From 1.40% on 19-09-2026

19-09-202619-10-2026

EPSS score

1.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Redhat199 products

openshift_container_platform3.4 | 3.5 | 3.6 | 3.7
ansible< 0:2.3.2.0-2.el7
ansible-asb-modules< 0:0.0.2-1.el7
ansible-doc< 0:2.3.2.0-2.el7
ansible-kubernetes-modules< 0:0.3.1-6.el7

ansible-service-broker< 0:1.0.19-1.el7
ansible-service-broker-container-scripts< 0:1.0.19-1.el7
ansible-service-broker-selinux< 0:1.0.19-1.el7
apb< 0:1.0.4-1.el7
apb-base-scripts< 0:1.0.5-1.el7
apb-container-scripts< 0:1.0.4-1.el7
atomic-openshift< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.4.1.44.38-1.git.0.d04b8d5.el7 | < 0:3.5.5.31.47-1.git.0.25d535c.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-clients< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.4.1.44.38-1.git.0.d04b8d5.el7 | < 0:3.5.5.31.47-1.git.0.25d535c.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-clients-redistributable< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.4.1.44.38-1.git.0.d04b8d5.el7 | < 0:3.5.5.31.47-1.git.0.25d535c.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-cluster-capacity< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-descheduler< 0:0.3.0-1.el7
atomic-openshift-docker-excluder< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.4.1.44.38-1.git.0.d04b8d5.el7 | < 0:3.5.5.31.47-1.git.0.25d535c.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-dockerregistry< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.4.1.44.38-1.git.0.d04b8d5.el7 | < 0:3.5.5.31.47-1.git.0.25d535c.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-excluder< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.4.1.44.38-1.git.0.d04b8d5.el7 | < 0:3.5.5.31.47-1.git.0.25d535c.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-federation-services< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-master< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.4.1.44.38-1.git.0.d04b8d5.el7 | < 0:3.5.5.31.47-1.git.0.25d535c.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-node< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.4.1.44.38-1.git.0.d04b8d5.el7 | < 0:3.5.5.31.47-1.git.0.25d535c.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-node-problem-detector< 0:3.7.0-0.el7
atomic-openshift-pod< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.4.1.44.38-1.git.0.d04b8d5.el7 | < 0:3.5.5.31.47-1.git.0.25d535c.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-sdn-ovs< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.4.1.44.38-1.git.0.d04b8d5.el7 | < 0:3.5.5.31.47-1.git.0.25d535c.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-service-catalog< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-template-service-broker< 0:3.7.9-1.git.0.7c71a2d.el7
atomic-openshift-tests< 0:3.7.9-1.git.0.7c71a2d.el7 | < 0:3.4.1.44.38-1.git.0.d04b8d5.el7 | < 0:3.5.5.31.47-1.git.0.25d535c.el7 | < 0:3.6.173.0.63-1.git.0.855ea8b.el7
atomic-openshift-utils< 0:3.7.9-1.git.4.d445616.el7
cockpit< 0:155-1.el7
cockpit-debuginfo< 0:155-1.el7
cockpit-kubernetes< 0:155-1.el7
containernetworking-plugins< 0:0.5.2-4.el7
containernetworking-plugins-debuginfo< 0:0.5.2-4.el7
cri-o< 0:1.0.4-2.git4aceede.el7
cri-o-debuginfo< 0:1.0.4-2.git4aceede.el7
dumb-init< 0:1.1.3-11.el7
dumb-init-debuginfo< 0:1.1.3-11.el7
elastic-curator< 0:3.5.0-2.el7
elasticsearch< 0:2.4.4-1.el7
elasticsearch-cloud-kubernetes< 0:2.4.4.01_redhat_1-1.el7
fb303< 0:0.9.1-14.el7
fb303-devel< 0:0.9.1-14.el7
fb303-java< 0:0.9.1-14.el7
fluentd< 0:0.12.39-2.el7
fluentd-doc< 0:0.12.39-2.el7
golang-github-openshift-oauth-proxy< 0:2.1-1.git885c9f40.el7
golang-github-openshift-prometheus-alert-buffer< 0:0-1.gitceca8c1.el7
golang-github-prometheus-alertmanager< 0:0.9.1-2.git9f5f4b2.el7
golang-github-prometheus-node_exporter< 0:0.15.1-1.gitba5da2c.el7
golang-github-prometheus-prometheus< 0:2.0.0-1.git0a74f98.el7
golang-github-prometheus-promu< 0:0-1.git85ceabc.el7
hawkular-openshift-agent< 0:1.2.2-1.el7
heapster< 0:1.3.0-2.el7
http-parser< 0:2.7.1-4.el7
http-parser-debuginfo< 0:2.7.1-4.el7
http-parser-devel< 0:2.7.1-4.el7
image-inspector< 0:2.1.2-1.el7
jenkins< 0:2.73.3-1.el7
jenkins-1< 0:1.651.2-2.el7
jenkins-2-plugins< 0:3.7.1510081324-1.el7
jenkins-plugin-ace-editor< 0:1.1-10.el7
jenkins-plugin-authentication-tokens< 0:1.3-1.el7
jenkins-plugin-blueocean< 0:1.1.2-1.el7
jenkins-plugin-blueocean-autofavorite< 0:0.7-1.el7
jenkins-plugin-blueocean-commons< 0:1.0.1-1.el7
jenkins-plugin-blueocean-config< 0:1.0.1-1.el7
jenkins-plugin-blueocean-dashboard< 0:1.0.1-1.el7
jenkins-plugin-blueocean-display-url< 0:2.0-1.el7
jenkins-plugin-blueocean-events< 0:1.0.1-1.el7
jenkins-plugin-blueocean-git-pipeline< 0:1.0.1-1.el7
jenkins-plugin-blueocean-github-pipeline< 0:1.0.1-1.el7
jenkins-plugin-blueocean-i18n< 0:1.0.1-1.el7
jenkins-plugin-blueocean-jwt< 0:1.0.1-1.el7
jenkins-plugin-blueocean-personalization< 0:1.0.1-1.el7
jenkins-plugin-blueocean-pipeline-api-impl< 0:1.0.1-1.el7
jenkins-plugin-blueocean-pipeline-editor< 0:0.2.0-1.el7
jenkins-plugin-blueocean-rest< 0:1.0.1-1.el7
jenkins-plugin-blueocean-rest-impl< 0:1.0.1-1.el7
jenkins-plugin-blueocean-web< 0:1.0.1-1.el7
jenkins-plugin-branch-api< 0:2.0.9-10.el7
jenkins-plugin-cloudbees-folder< 0:6.0.4-10.el7
jenkins-plugin-credentials< 0:2.1.13-10.el7
jenkins-plugin-credentials-binding< 0:1.11-1.el7
jenkins-plugin-display-url-api< 0:2.0-10.el7
jenkins-plugin-docker-commons< 0:1.6-1.el7
jenkins-plugin-docker-workflow< 0:1.11-1.el7
jenkins-plugin-durable-task< 0:1.13-10.el7
jenkins-plugin-favorite< 0:2.0.4-1.el7
jenkins-plugin-git< 0:3.3.0-10.el7
jenkins-plugin-git-client< 0:2.4.5-10.el7
jenkins-plugin-git-server< 0:1.7-10.el7
jenkins-plugin-github< 0:1.27.0-1.el7
jenkins-plugin-github-api< 0:1.85-1.el7
jenkins-plugin-github-branch-source< 0:2.0.5-1.el7
jenkins-plugin-handlebars< 0:1.1.1-10.el7
jenkins-plugin-icon-shim< 0:2.0.3-10.el7
jenkins-plugin-jackson2-api< 0:2.7.3-1.el7
jenkins-plugin-jquery-detached< 0:1.2.1-10.el7
jenkins-plugin-junit< 0:1.20-10.el7
jenkins-plugin-kubernetes< 0:0.11-10.el7
jenkins-plugin-mailer< 0:1.20-10.el7
jenkins-plugin-mapdb-api< 0:1.0.9.0-10.el7
jenkins-plugin-matrix-auth< 0:1.5-10.el7
jenkins-plugin-matrix-project< 0:1.10-10.el7
jenkins-plugin-mercurial< 0:1.59-10.el7
jenkins-plugin-metrics< 0:3.1.2.9-1.el7
jenkins-plugin-momentjs< 0:1.1.1-10.el7
jenkins-plugin-multiple-scms< 0:0.6-10.el7
jenkins-plugin-openshift-client< 0:0.9.6-1.el7
jenkins-plugin-openshift-login< 0:0.12-10.el7
jenkins-plugin-openshift-pipeline< 0:1.0.47-10.el7
jenkins-plugin-openshift-sync< 0:0.1.24-1.el7
jenkins-plugin-pipeline-build-step< 0:2.1-10.el7
jenkins-plugin-pipeline-graph-analysis< 0:1.3-10.el7
jenkins-plugin-pipeline-input-step< 0:2.7-10.el7
jenkins-plugin-pipeline-milestone-step< 0:1.3.1-1.el7
jenkins-plugin-pipeline-model-api< 0:1.1.4-1.el7
jenkins-plugin-pipeline-model-declarative-agent< 0:1.1.1-1.el7
jenkins-plugin-pipeline-model-definition< 0:1.1.4-1.el7
jenkins-plugin-pipeline-model-extensions< 0:1.1.4-1.el7
jenkins-plugin-pipeline-rest-api< 0:2.6-10.el7
jenkins-plugin-pipeline-stage-step< 0:2.2-10.el7
jenkins-plugin-pipeline-stage-tags-metadata< 0:1.1.4-1.el7
jenkins-plugin-pipeline-stage-view< 0:2.6-10.el7
jenkins-plugin-pipeline-utility-steps< 0:1.3.0-10.el7
jenkins-plugin-plain-credentials< 0:1.4-10.el7
jenkins-plugin-pubsub-light< 0:1.8-1.el7
jenkins-plugin-scm-api< 0:2.1.1-10.el7
jenkins-plugin-script-security< 0:1.29-1.el7
jenkins-plugin-sse-gateway< 0:1.15-1.el7
jenkins-plugin-ssh-credentials< 0:1.13-10.el7
jenkins-plugin-structs< 0:1.6-10.el7
jenkins-plugin-subversion< 0:2.7.2-10.el7
jenkins-plugin-token-macro< 0:2.1-1.el7
jenkins-plugin-variant< 0:1.1-1.el7
jenkins-plugin-workflow-aggregator< 0:2.1-10.el7
jenkins-plugin-workflow-api< 0:2.13-10.el7
jenkins-plugin-workflow-basic-steps< 0:2.4-10.el7
jenkins-plugin-workflow-cps< 0:2.30-10.el7
jenkins-plugin-workflow-cps-global-lib< 0:2.8-10.el7
jenkins-plugin-workflow-durable-task-step< 0:2.11-10.el7
jenkins-plugin-workflow-job< 0:2.10-10.el7
jenkins-plugin-workflow-multibranch< 0:2.14-10.el7
jenkins-plugin-workflow-remote-loader< 0:1.4-10.el7
jenkins-plugin-workflow-scm-step< 0:2.4-10.el7
jenkins-plugin-workflow-step-api< 0:2.9-10.el7
jenkins-plugin-workflow-support< 0:2.14-10.el7
kibana< 0:4.6.4-3.el7
kibana-debuginfo< 0:4.6.4-3.el7
libthrift-java< 0:0.9.1-14.el7
libthrift-javadoc< 0:0.9.1-14.el7
libuv< 1:1.7.5-3.el7
libuv-debuginfo< 1:1.7.5-3.el7
libuv-devel< 1:1.7.5-3.el7
libuv-static< 1:1.7.5-3.el7
mariadb-apb-role< 0:1.0.10-1.el7
mediawiki-apb-role< 0:1.0.7-2.el7
mediawiki-container-scripts< 0:1.0.2-1.el7
mediawiki123< 0:1.23.13-1.el7
mediawiki123-doc< 0:1.23.13-1.el7
mysql-apb-role< 0:1.0.10-1.el7
nodejs< 0:4.7.2-1.el7
nodejs-abbrev< 0:1.0.7-1.el7aos
nodejs-accepts< 0:1.3.3-1.el7
nodejs-align-text< 0:0.1.3-2.el7aos
nodejs-amdefine< 0:0.0.4-5.el7aos
nodejs-ansi-regex< 0:2.0.0-1.el7aos
nodejs-ansi-styles< 0:2.1.0-1.el7aos
nodejs-argparse< 0:1.0.3-1.el7aos
nodejs-array-flatten< 0:1.1.1-1.el7aos
nodejs-asap< 0:2.0.3-1.el7aos
nodejs-asn1< 0:0.1.11-4.el7aos
nodejs-assert-plus< 0:0.1.4-1.el7aos
nodejs-async< 0:1.4.2-1.el7aos
nodejs-aws-sign2< 0:0.5.0-1.el7aos
nodejs-balanced-match< 0:0.2.1-1.el7aos
nodejs-base64url< 0:1.0.4-2.el7aos
nodejs-basic-auth< 0:1.0.3-1.el7aos
nodejs-bl< 0:1.0.0-3.el7aos
nodejs-bluebird< 0:2.10.0-1.el7aos
nodejs-body-parser< 0:1.14.1-1.el7aos
nodejs-boom< 0:2.8.0-1.el7aos
nodejs-brace-expansion< 0:1.1.1-1.el7aos
nodejs-bytes< 0:2.1.0-1.el7aos
nodejs-camelcase< 0:1.2.1-2.el7aos
nodejs-camelcase-keys< 0:1.0.0-2.el7aos
nodejs-caseless< 0:0.11.0-1.el7aos
nodejs-center-align< 0:0.1.1-1.el7aos
nodejs-chalk< 0:1.1.1-2.el7aos
nodejs-client-sessions< 0:0.7.0-2.el7aos
nodejs-cliui< 0:2.1.0-2.el7aos
nodejs-coffee-script< 0:1.10.0-1.el7aos
nodejs-colors< 0:1.1.2-1.el7aos
nodejs-combined-stream< 0:1.0.5-1.el7aos
nodejs-commander< 0:2.8.1-2.el7aos
nodejs-concat-map< 0:0.0.1-1.el7aos
nodejs-concat-stream< 0:1.4.7-3.el7aos
nodejs-content-disposition< 0:0.5.0-1.el7aos

Show all 199

Red hat1 product

openshiftall

2 vendors · 200 products · Showing 200 of 550. Use Open JSON for the complete list.

References

552 links

access.redhat.com/errata/RHSA-2017:3188Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12195X Refsource CONFIRMIssue TrackingThird Party Advisory
access.redhat.com/errata/RHSA-2017:3389Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
access.redhat.com/security/updates/classification/ARTICLE
docs.openshift.com/container-platform/3.7/release_notes/ocp_3_7_release_notes.htmlARTICLE
bugzilla.redhat.com/show_bug.cgi?id=1270436REPORT
bugzilla.redhat.com/show_bug.cgi?id=1292507REPORT
bugzilla.redhat.com/show_bug.cgi?id=1316364REPORT
bugzilla.redhat.com/show_bug.cgi?id=1328913REPORT
bugzilla.redhat.com/show_bug.cgi?id=1356478REPORT

Show all 100 references

Showing 100 of 552. Use Open JSON for the complete list.

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities