PT-2020-10138 · Red Hat · Openshift

Badre Tejado-Imam + 2 · Published 2020-03-18 · Updated 2023-02-12 · CVE-2019-19335

Positive Technologies (AI Summary)

CVSS v3.1

4.4

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenShift versions 4.2

Description The issue arises during the installation of an OpenShift 4 cluster, where the openshift-install command line tool creates an auth directory. This directory contains kubeconfig and kubeadmin-password files, which hold credentials for authenticating to the OpenShift API server. However, these files are incorrectly assigned word-readable permissions, potentially exposing the credentials.

Recommendations For OpenShift version 4.2, ensure the kubeconfig and kubeadmin-password files have appropriate permissions to prevent unauthorized access. Consider restricting access to these files until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2019-19335

Affected Products

Openshift

References · 4

• https://osv.dev/vulnerability/CVE-2019-19335 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-19335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19335 · Security Note
• https://t.me/cvenotify/1861 · Telegram Post