PT-2021-13834 · Red Hat · Openshift Installer+1

Sam Fowler · Published 2021-02-23 · Updated 2021-02-27 · CVE-2021-20198

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: OpenShift Installer versions prior to v0.9.0-master.0.20210125200451-95101da940b0

Description: A flaw was found in the OpenShift Installer. During installation of OpenShift Container Platform 4 clusters, bootstrap nodes are provisioned with anonymous authentication enabled on kubelet port 10250. A remote attacker able to reach this port during installation can make unauthenticated /exec requests to execute arbitrary commands within running containers. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Recommendations: For OpenShift Installer versions prior to v0.9.0-master.0.20210125200451-95101da940b0, update to version v0.9.0-master.0.20210125200451-95101da940b0 or later to resolve the issue. As a temporary workaround, consider disabling anonymous authentication on kubelet port 10250 during installation to minimize the risk of exploitation. Restrict access to the /exec endpoint to prevent unauthenticated requests.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-20198

Affected Products

Openshift Container Platform

Openshift Installer

References · 6

• https://bugzilla.redhat.com/show_bug.cgi?id=1920764 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20198 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20198 · Vendor Advisory
• https://t.me/cibsecurity/23998 · Telegram Post
• https://t.me/cvenotify/10369 · Telegram Post
• https://t.me/cvenotify/10395 · Telegram Post