PT-2021-8867 · Red Hat · Openshift Container Platform 4

Published 2021-03-19 · Updated 2021-03-26 · CVE-2019-10200

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OpenShift Container Platform 4 (affected versions not specified)

Description A flaw was discovered where users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS IAM role, allowing management access to AWS resources. With access to the security credentials, the user then has access to the entire infrastructure. Impact to data and system availability is high.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2019-10200

Affected Products

Openshift Container Platform 4

References · 5

• https://github.com/openshift/cluster-kube-apiserver-operator/pull/524 · Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=1730161 · Patch
• https://osv.dev/vulnerability/CVE-2019-10200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10200 · Security Note
• https://t.me/cibsecurity/25203 · Telegram Post