PT-2019-5507 · Red Hat · Openshift

Pedro Sampaio · Published 2019-09-23 · Updated 2023-02-12 · CVE-2019-14845

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenShift versions 4.1 up to 4.3 OpenShift builds (affected versions not specified, but includes versions that extract source from a container image)

Description The issue is related to a lack of code integrity verification, allowing for potential man-in-the-middle attacks. An attacker can exploit this to inject malicious content. The vulnerability affects OpenShift builds that extract source from a container image, bypassing TLS hostname verification.

Recommendations For OpenShift versions 4.1 up to 4.3, consider restricting access to the builds feature until a patch is available. As a temporary workaround, consider disabling the extraction of source from container images in OpenShift builds to minimize the risk of exploitation. Avoid using the builds feature in OpenShift for versions 4.1 up to 4.3 until the issue is resolved.

Fix

Weakness Enumeration

CWE-494

Related Identifiers

BDU:2020-03325

CVE-2019-14845

Affected Products

Openshift

References · 7

• https://osv.dev/vulnerability/CVE-2019-14845 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:4101 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14845 · Security Note
• https://access.redhat.com/errata/RHSA-2019:4237 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14845 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03325 · Security Note
• https://access.redhat.com/security/cve/cve-2019-14845 · Note