Skip to content
Fencer Intel
high 8.8

CVE-2018-1102 json

A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x.

published 2018-04-30 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-11750

cvss
8.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.4%
EPSS 2.4% chance of exploitation in 30 days, percentile 84%
public exploits
0
none known

Summary

A flaw was found in source-to-image function as shipped with Openshift Enterprise 3.x. An improper path validation of tar files in ExtractTarStreamFromTarReader in tar/tar.go leads to privilege escalation.

Patch / fix

  • source-to-image RHEL 3 SOFTWARE_COLLECTIONS 1.1.13-1.el7
  • atomic-openshift openshift 3.9 3.9.25-1.git.0.6bc473e.el7
  • atomic-openshift-pod openshift 3.9 3.9.25-1.git.0.6bc473e.el7
  • atomic-openshift-node openshift 3.9 3.9.25-1.git.0.6bc473e.el7
  • atomic-openshift-tests openshift 3.9 3.9.25-1.git.0.6bc473e.el7
  • atomic-openshift-master openshift 3.9 3.9.25-1.git.0.6bc473e.el7
  • atomic-openshift-clients openshift 3.9 3.9.25-1.git.0.6bc473e.el7
  • atomic-openshift-sdn-ovs openshift 3.9 3.9.25-1.git.0.6bc473e.el7

red hat advisories RHSA-2019:0036RHSA-2018:1227RHSA-2018:1241RHSA-2018:1239RHSA-2018:1237RHSA-2018:1235

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1102 updated cvss 9.9

source-to-image: Improper path sanitization in ExtractTarStreamFromTarReader in tar/tar.go

  • Red Hat OpenShift Container Platform 3.2 atomic-openshift 3.2.1.34-2.git.3.aad33c3.el7, atomic-openshift-pod 3.2.1.34-2.git.3.aad33c3.el7, atomic-openshift-node 3.2.1.34-2.git.3.aad33c3.el7, atomic-openshift-tests 3.2.1.34-2.git.3.aad33c3.el7, atomic-openshift-master 3.2.1.34-2.git.3.aad33c3.el7, atomic-openshift-clients 3.2.1.34-2.git.3.aad33c3.el7, +7 more
    fixed: vendor fix RHSA-2018:1241
  • Red Hat OpenShift Container Platform 3.3 atomic-openshift 3.3.1.46.39-2.git.3.cc57f5b.el7, atomic-openshift-pod 3.3.1.46.39-2.git.3.cc57f5b.el7, atomic-openshift-node 3.3.1.46.39-2.git.3.cc57f5b.el7, atomic-openshift-tests 3.3.1.46.39-2.git.3.cc57f5b.el7, atomic-openshift-master 3.3.1.46.39-2.git.3.cc57f5b.el7, atomic-openshift-clients 3.3.1.46.39-2.git.3.cc57f5b.el7, +6 more
    fixed: vendor fix RHSA-2018:1239
  • Red Hat OpenShift Container Platform 3.4 python-ruamel-yaml 0.12.14-9.el7, python2-ruamel-yaml 0.12.14-9.el7, openshift-ansible 3.4.168-1.git.0.bb73aad.el7, atomic-openshift 3.4.1.44.53-1.git.0.d7eb028.el7, atomic-openshift-utils 3.4.168-1.git.0.bb73aad.el7, openshift-ansible-roles 3.4.168-1.git.0.bb73aad.el7, +15 more
    fixed: vendor fix RHSA-2018:1237
  • Red Hat OpenShift Container Platform 3.5 openshift-ansible 3.5.165-1.git.0.475fa67.el7, atomic-openshift 3.5.5.31.67-1.git.0.0a8cf24.el7, atomic-openshift-utils 3.5.165-1.git.0.475fa67.el7, openshift-ansible-roles 3.5.165-1.git.0.475fa67.el7, atomic-openshift-pod 3.5.5.31.67-1.git.0.0a8cf24.el7, atomic-openshift-node 3.5.5.31.67-1.git.0.0a8cf24.el7, +13 more
    fixed: vendor fix RHSA-2018:1235
  • Red Hat OpenShift Container Platform 3.6 rubygem-ffi 1.9.23-1.el7, rubygem-excon 0.60.0-1.el7, rubygem-tzinfo 1.2.5-1.el7, rubygem-cool.io 1.5.3-1.el7, rubygem-msgpack 1.2.2-1.el7, rubygem-faraday 0.13.1-1.el7, +22 more
    fixed: vendor fix RHSA-2018:1233
  • Red Hat OpenShift Container Platform 3.7 apb 1.0.6-1.el7, apb-container-scripts 1.0.6-1.el7, atomic-openshift 3.7.44-1.git.0.6b061d4.el7, atomic-openshift-pod 3.7.44-1.git.0.6b061d4.el7, atomic-openshift-node 3.7.44-1.git.0.6b061d4.el7, rubygem-fluent-plugin-elasticsearch 1.14.0-1.el7, +13 more
    fixed: vendor fix RHSA-2018:1231
  • Red Hat OpenShift Container Platform 3.8 atomic-openshift 3.8.37-1.git.0.e85a326.el7, openshift-ansible 3.8.37-1.git.0.be319af.el7, atomic-openshift-pod 3.8.37-1.git.0.e85a326.el7, atomic-openshift-node 3.8.37-1.git.0.e85a326.el7, atomic-openshift-tests 3.8.37-1.git.0.e85a326.el7, atomic-openshift-utils 3.8.37-1.git.0.be319af.el7, +14 more
    fixed: vendor fix RHSA-2018:1229
  • Red Hat OpenShift Container Platform 3.9 atomic-openshift 3.9.25-1.git.0.6bc473e.el7, atomic-openshift-pod 3.9.25-1.git.0.6bc473e.el7, atomic-openshift-node 3.9.25-1.git.0.6bc473e.el7, atomic-openshift-tests 3.9.25-1.git.0.6bc473e.el7, atomic-openshift-master 3.9.25-1.git.0.6bc473e.el7, atomic-openshift-clients 3.9.25-1.git.0.6bc473e.el7, +8 more
    fixed: vendor fix RHSA-2018:1227
show 2 more
  • Red Hat OpenShift Enterprise 3.1 atomic-openshift 3.1.1.11-4.git.3.12809c8.el7, atomic-openshift-pod 3.1.1.11-4.git.3.12809c8.el7, atomic-openshift-node 3.1.1.11-4.git.3.12809c8.el7, atomic-openshift-master 3.1.1.11-4.git.3.12809c8.el7, atomic-openshift-clients 3.1.1.11-4.git.3.12809c8.el7, atomic-openshift-recycle 3.1.1.11-4.git.3.12809c8.el7, +6 more
    fixed: vendor fix RHSA-2018:1243
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) source-to-image 1.1.13-1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4) source-to-image 1.1.13-1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5) source-to-image 1.1.13-1.el7 Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6) source-to-image 1.1.13-1.el7
    fixed: vendor fix RHSA-2019:0036

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.42% chance of exploitation in the next 30 days, higher than 84% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • Red Hat, Inc. atomic-openshift

Classification

Weakness
  • CWE-20 Improper Input Validation
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.