PT-2020-12293 · Red Hat · Openshift Container Platform

Published 2020-04-22 · Updated 2023-02-12 · CVE-2020-10712

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenShift Container Platform versions 4.1 and later

Description A flaw was found in the software where sensitive information was logged by the image registry operator. This allows an attacker who gains access to those logs to read and write to the storage backing the internal image registry. The highest threat from this issue is to data integrity.

Recommendations For OpenShift Container Platform versions 4.1 and later, consider restricting access to the logs of the image registry operator to minimize the risk of exploitation. As a temporary workaround, limit write access to the storage backing the internal image registry until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2020-10712

Affected Products

Openshift Container Platform

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-10712 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10712 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10712 · Note
• https://t.me/cvenotify/3047 · Telegram Post