Vulnerability-Lookup

CNVD-2020-42016

Vulnerability from cnvd - Published: 2020-07-24

Title

Red Hat OpenShift Container Platform日志信息泄露漏洞

Description

Red Hat OpenShift Container Platform是美国红帽（Red Hat）公司的一套可帮助企业在物理、虚拟和公共云基础架构之间开发、部署和管理现有基于容器的应用程序的应用平台。 Red Hat OpenShift Container Platform 4.1及之后版本中存在日志信息泄露漏洞。攻击者可利用该漏洞访问日志，并对支持内部映像注册表的存储信息进行读写操作，影响数据的完整性。

Severity

中

Formal description

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://www.openshift.com/

Reference

https://access.redhat.com/security/cve/cve-2020-10712

Impacted products

Name
Red Hat Red Hat OpenShift Container Platform >=4.1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-10712",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-10712"
    }
  },
  "description": "Red Hat OpenShift Container Platform\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4e00\u5957\u53ef\u5e2e\u52a9\u4f01\u4e1a\u5728\u7269\u7406\u3001\u865a\u62df\u548c\u516c\u5171\u4e91\u57fa\u7840\u67b6\u6784\u4e4b\u95f4\u5f00\u53d1\u3001\u90e8\u7f72\u548c\u7ba1\u7406\u73b0\u6709\u57fa\u4e8e\u5bb9\u5668\u7684\u5e94\u7528\u7a0b\u5e8f\u7684\u5e94\u7528\u5e73\u53f0\u3002\n\nRed Hat OpenShift Container Platform 4.1\u53ca\u4e4b\u540e\u7248\u672c\u4e2d\u5b58\u5728\u65e5\u5fd7\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u65e5\u5fd7\uff0c\u5e76\u5bf9\u652f\u6301\u5185\u90e8\u6620\u50cf\u6ce8\u518c\u8868\u7684\u5b58\u50a8\u4fe1\u606f\u8fdb\u884c\u8bfb\u5199\u64cd\u4f5c\uff0c\u5f71\u54cd\u6570\u636e\u7684\u5b8c\u6574\u6027\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://www.openshift.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-42016",
  "openTime": "2020-07-24",
  "products": {
    "product": "Red Hat Red Hat OpenShift Container Platform \u003e=4.1"
  },
  "referenceLink": "https://access.redhat.com/security/cve/cve-2020-10712",
  "serverity": "\u4e2d",
  "submitTime": "2020-04-22",
  "title": "Red Hat OpenShift Container Platform\u65e5\u5fd7\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2020-10712 (GCVE-0-2020-10712)

Vulnerability from cvelistv5 – Published: 2020-04-22 15:29 – Updated: 2024-08-04 11:14

Summary

A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry operator allowing an attacker able to gain access to those logs, to read and write to the storage backing the internal image registry. The highest threat from this vulnerability is to data integrity.

Severity ?

7 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

CWE

CWE-532

Assigner

redhat

References

URL

Tags

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…

x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Red Hat	openshift/cluster-image-registry-operator	Affected: all ose-cluster-image-registry-operator-container 4.1 versions and later

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:14:14.214Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10712"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "openshift/cluster-image-registry-operator",
          "vendor": "Red Hat",
          "versions": [
            {
              "status": "affected",
              "version": "all ose-cluster-image-registry-operator-container 4.1 versions and later"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in OpenShift Container Platform version 4.1 and later. Sensitive information was found to be logged by the image registry operator allowing an attacker able to gain access to those logs, to read and write to the storage backing the internal image registry. The highest threat from this vulnerability is to data integrity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-22T15:29:40",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10712"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-10712",
    "datePublished": "2020-04-22T15:29:40",
    "dateReserved": "2020-03-20T00:00:00",
    "dateUpdated": "2024-08-04T11:14:14.214Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-42016

CVE-2020-10712 (GCVE-0-2020-10712)

Tags

Sightings

Nomenclature