CVE-2016-7075 HIGH

CVE-2016-7075

Vendor Red Hat

Product OpenShift

Weakness CWE-295

Published September 10, 2018

Last update August 6, 2024

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

It was found that Kubernetes as used by Openshift Enterprise 3 did not correctly validate X.509 client intermediate certificate host name fields. An attacker could use this flaw to bypass authentication requirements by using a specially crafted X.509 certificate.

Key dates

02Disclosure timeline

September 10, 2018 CVE published

August 6, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2016-7075 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/295.html

Related vulnerabilities

04Related CVE

CVE-2026-42012 Gnutls: gnutls: certificate validation bypass due to improper handling of uri and srv sans CVE-2022-33683 Disabled Certificate Validation makes Broker, Proxy Admin Clients vulnerable to MITM attack CVE-2021-34599 Improper Certificate Validation in CODESYS Git CVE-2026-25961 SumatraPDF Update MITM -> Arbitrary Code Execution CVE-2025-58123 Lack of TLS validation in plugin BGP Monitoring on Checkmk Exchange