CVE-2018-10843: redhat openshift_container_platform Improper Input Validation
Vulnerability summary
CVE-2018-10843 is a high (CVSS 9.0) Improper Input Validation vulnerability in redhat openshift_container_platform. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 71.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 02-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
source-to-image component of Openshift Container Platform before versions atomic-openshift 3.7.53, atomic-openshift 3.9.31 is vulnerable to a privilege escalation which allows the assemble script to run as the root user in a non-privileged container. An attacker can use this flaw to open network connections, and possibly other actions, on the host which are normally only available to a root user.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST8.8HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
1.39%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
+0.03 pp
From 1.36% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
Affected systems
[unknown]1 product
- source-to-imageatomic-openshift 3.7.53 | atomic-openshift 3.9.31
Redhat1 product
- openshift_container_platform< 3.7.53 | 3.9 | 3.9.31
2 vendors · 2 products