CVE-2018-1103: Improper Input Validation
Openshift Enterprise source-to-image before version 1.1.10 is vulnerable to an improper validation of user input. An attacker who could trick a user into using the command to copy files locally, from a pod, could override files outside of the target directory of the command.
References
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1103
- github.com/advisories/GHSA-w55j-f7vx-6q37
- github.com/openshift/source-to-image/commit/f5cbcbc5cc6f8cc2f479a7302443bea407a700cb
- github.com/openshift/source-to-image/pull/870
- github.com/snyk/zip-slip-vulnerability
- hansmi.ch/articles/2018-04-openshift-s2i-security
- nvd.nist.gov/vuln/detail/CVE-2018-1103
- pkg.go.dev/vuln/GO-2020-0026
- snyk.io/research/zip-slip-vulnerability
Code Behaviors & Features
Detect and mitigate CVE-2018-1103 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →