PT-2019-11604 · Red Hat · Openshift Container Platform

Tatianab · Published 2019-07-30 · Updated 2020-10-02 · CVE-2019-10165

Positive Technologies (AI Summary)

CVSS v3.1

2.3

Low

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform versions prior to 4.1.3

Description: The issue allows a user with sufficient privileges to recover OAuth tokens from audit logs for the Kubernetes API server and OpenShift API server. These tokens can then be used to access other resources.

Recommendations: For versions prior to 4.1.3, update to version 4.1.3 or later to resolve the issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2019-10165

Affected Products

Openshift Container Platform

References · 5

• https://github.com/openshift/cluster-openshift-apiserver-operator/pull/205 · Patch
• https://osv.dev/vulnerability/CVE-2019-10165 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10165 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10165 · Vendor Advisory
• https://github.com/openshift/cluster-kube-apiserver-operator/pull/499 · Patch