CVE-2014-3496

Name of the Vulnerable Software and Affected Versions OpenShift Origin and Enterprise versions 1.2.8 through 2.1.1

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in a Source-Url ending with certain file extensions in a cartridge manifest file. This can occur with file extensions such as .tar.gz, .zip, .tgz, or .tar.

Recommendations For OpenShift Origin and Enterprise versions 1.2.8 through 2.1.1, consider restricting the use of cartridge manifest files with untrusted Source-Url entries to minimize the risk of exploitation. Avoid using the Source-Url parameter with unverified file extensions in the cartridge manifest file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.