PT-2020-9605 · Red Hat · Openshift Container Platform

Jason Shepherd · Published 2020-01-07 · Updated 2023-02-12 · CVE-2019-14819

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenShift Container Platform versions 3.x

Description A flaw was discovered in the upgrade process of OpenShift Container Platform, specifically when using CRI-O. The issue allows an unprivileged user to escalate their privileges to those allowed by the privileged Security Context Constraints, as the dockergc service account is assigned to the current namespace of the user performing the upgrade.

Recommendations For OpenShift Container Platform versions 3.x, consider restricting the privileges assigned to the dockergc service account during the upgrade process to prevent unauthorized privilege escalation. As a temporary workaround, limit the use of CRI-O during upgrades until a more permanent solution is available.

Exploit

Fix

Improper Privilege Management

Incorrect Privilege Assignment

Weakness Enumeration

CWE-269

CWE-266

CWE-270

Related Identifiers

CVE-2019-14819

RHSA-2019:2818

Affected Products

Openshift Container Platform

References · 3

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14819 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14819 · Security Note
• https://osv.dev/vulnerability/CVE-2019-14819 · Vendor Advisory