Re: CVE request for Kubernetes api server: build config to a strategy that isn't allowed by policy

[Kurt Seifried <kseifried () redhat com>]

Ping, Mitre can I get a CVE here please? Also for the other Kubertes issue.

On Tue, Jan 12, 2016 at 11:04 AM, Kurt Seifried <kseifried () redhat com>
wrote:

> CVE request (one is the problem, the other the fix):
>
> https://github.com/openshift/origin/issues/6556
> https://github.com/openshift/origin/pull/6576
>
> You can modify a build so that it escalates privileges when built, you
> can't build it yourself (that fails) but if the imagestream trigger is used
> then it would build and you'd have escalated privileges.
>
> --
>
> --
> Kurt Seifried -- Red Hat -- Product Security -- Cloud
> PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
> Red Hat Product Security contact: secalert () redhat com



-- 

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert () redhat com