CVE-2018-17246
Fixed in a distro release EPSS 84%
Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands with permissions of the Kibana process on the host system.
Products: Elastic Kibana
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openshift 3.11 | atomic-enterprise-service-catalog | 1:3.11.51-1.git.1671.2d16650.el7 |
| Red Hat openshift 3.11 | atomic-enterprise-service-catalog-svcat | 1:3.11.51-1.git.1671.2d16650.el7 |
| Red Hat openshift 3.11 | atomic-openshift | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-clients | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-clients-redistributable | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-cluster-autoscaler | 0:3.11.51-1.git.0.0aa9fc2.el7 |
| Red Hat openshift 3.11 | atomic-openshift-descheduler | 0:3.11.51-1.git.300.89070e8.el7 |
| Red Hat openshift 3.11 | atomic-openshift-docker-excluder | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-dockerregistry | 0:3.11.51-1.git.446.d29ce0e.el7 |
| Red Hat openshift 3.11 | atomic-openshift-excluder | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-hyperkube | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-hypershift | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-master | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-metrics-server | 0:3.11.51-1.git.52.03e3a91.el7 |
| Red Hat openshift 3.11 | atomic-openshift-node | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-node-problem-detector | 0:3.11.51-1.git.254.22189b0.el7 |
| Red Hat openshift 3.11 | atomic-openshift-pod | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-sdn-ovs | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-service-idler | 0:3.11.51-1.git.14.813574a.el7 |
| Red Hat openshift 3.11 | atomic-openshift-template-service-broker | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-tests | 0:3.11.51-1.git.0.1560686.el7 |
| Red Hat openshift 3.11 | atomic-openshift-web-console | 0:3.11.51-1.git.324.0ae64ed.el7 |
| Red Hat openshift 3.11 | cri-o | 0:1.11.10-1.rhaos3.11.git42c86f0.el7 |
| Red Hat openshift 3.11 | cri-o-debuginfo | 0:1.11.10-1.rhaos3.11.git42c86f0.el7 |
| Red Hat openshift 3.11 | golang-github-openshift-oauth-proxy | 0:3.11.51-1.git.419.1af74df.el7 |
| Red Hat openshift 3.11 | golang-github-prometheus-alertmanager | 0:3.11.51-1.git.0.50a0687.el7 |
| Red Hat openshift 3.11 | golang-github-prometheus-node_exporter | 0:3.11.51-1.git.1063.12dd8be.el7 |
| Red Hat openshift 3.11 | golang-github-prometheus-prometheus | 0:3.11.51-1.git.5023.0ad933c.el7 |
| Red Hat openshift 3.11 | jenkins | 0:2.138.2.1542054911-1.el7 |
| Red Hat openshift 3.11 | jenkins-2-plugins | 0:3.11.1542061886-1.el7 |
| Red Hat openshift 3.11 | kibana | 0:5.6.13-1.el7 |
| Red Hat openshift 3.11 | kibana-debuginfo | 0:5.6.13-1.el7 |
| Red Hat openshift 3.11 | openshift-ansible | 0:3.11.51-2.git.0.51c90a3.el7 |
| Red Hat openshift 3.11 | openshift-ansible-docs | 0:3.11.51-2.git.0.51c90a3.el7 |
| Red Hat openshift 3.11 | openshift-ansible-playbooks | 0:3.11.51-2.git.0.51c90a3.el7 |
| Red Hat openshift 3.11 | openshift-ansible-roles | 0:3.11.51-2.git.0.51c90a3.el7 |
| Red Hat openshift 3.11 | openshift-ansible-test | 0:3.11.51-2.git.0.51c90a3.el7 |
| Red Hat openshift 3.11 | openshift-enterprise-autoheal | 0:3.11.51-1.git.219.8ea4275.el7 |
| Red Hat openshift 3.11 | openshift-enterprise-cluster-capacity | 0:3.11.51-1.git.380.ffa21af.el7 |
| Red Hat openshift 3.11 | openshift-monitor-project-lifecycle | 0:3.11.51-1.git.59.7b59e29.el7 |
| Red Hat openshift 3.11 | openshift-monitor-sample-app | 0:3.11.51-1.git.5.f6d0188.el7 |
| Red Hat openshift 3.11 | prometheus | 0:3.11.51-1.git.5023.0ad933c.el7 |
| Red Hat openshift 3.11 | prometheus-alertmanager | 0:3.11.51-1.git.0.50a0687.el7 |
| Red Hat openshift 3.11 | prometheus-node-exporter | 0:3.11.51-1.git.1063.12dd8be.el7 |