VYPR
← All advisories
Unrated severityNVD Advisory· Published Nov 13, 2014· Updated May 6, 2026

CVE-2014-3602

CVE-2014-3602

Description

Red Hat OpenShift Enterprise before 2.2 allows local users to obtain IP address and port number information for remote systems by reading /proc/net/tcp.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Red Hat OpenShift Enterprise 2.1 and earlier allow local users on a node to read remote system IP addresses and port numbers via /proc/net/tcp.

Vulnerability

Red Hat OpenShift Enterprise before version 2.2 allows a local user on a node to obtain the IP address and port number of remote systems that the node is communicating with by reading the /proc/net/tcp file. Affected versions are all releases prior to OpenShift Enterprise 2.2 [1] [2].

Exploitation

An attacker must have local shell access to an OpenShift node (e.g. as a gear user or via a container). No special privileges are required beyond those of a standard local user. The attacker simply reads the /proc/net/tcp file, which is world-readable by default, to enumerate active TCP connections [1].

Impact

A successful read of /proc/net/tcp discloses the IP addresses and port numbers of remote systems that the node is communicating with. This information leakage could aid an attacker in network reconnaissance or in identifying other systems to target [1].

Mitigation

The vulnerability is fixed in Red Hat OpenShift Enterprise 2.2, released on 2014-11-12 (RHSA-2014:1796) [1]. Users are advised to upgrade to version 2.2. No workaround is provided in the references. The issue is not listed on CISA’s Known Exploited Vulnerabilities catalog.

References
  1. http://rhn.redhat.com/errata/RHSA-2014-1796.html
  2. http://rhn.redhat.com/errata/RHSA-2014-1906.html

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

17
  • Red Hat/Openshift16 versions
    cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*+ 15 more
    • cpe:2.3:a:redhat:openshift:2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift:2.0.1:*:enterprise:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift:2.0.2:*:enterprise:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift:2.0.3:*:enterprise:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift:2.0.4:*:enterprise:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift:2.0.5:*:enterprise:*:*:*:*:*
    • cpe:2.3:a:redhat:openshift:2.0.6:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:redhat:openshift:2.1.1:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:redhat:openshift:2.1.2:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:redhat:openshift:2.1.3:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:redhat:openshift:2.1.4:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:redhat:openshift:2.1.5:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:redhat:openshift:2.1.6:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:redhat:openshift:2.1.7:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:redhat:openshift:2.1:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:redhat:openshift:*:*:*:*:enterprise:*:*:*range: <=2.1.8
  • Red Hat/OpenShift Enterprisellm-fuzzy
    Range: <2.2

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

2

News mentions

0

No linked articles in our index yet.