RHBA-2020:0581
Vulnerability from csaf_redhat - Published: 2020-05-04 11:12 - Updated: 2026-10-30 18:05Summary
Red Hat Bug Fix Advisory: OpenShift Container Platform 4.4 image release advisory
Severity
Important
Notes
Topic: Red Hat OpenShift Container Platform release 4.4.3 is now available with
updates to packages and images that fix several bugs and add enhancements.
Details: Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat
OpenShift Container Platform 4.4.3. See the following advisory for the
RPM packages for this release:
https://access.redhat.com/errata/RHBA-2020:0582
Space precludes documenting all of the bug fixes and enhancements in this
advisory, as well as all of the container images in this advisory. See the
following Release Notes documentation, which will be updated shortly for
this release, for details about these changes:
https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html
You may download the oc tool and use it to inspect release image metadata as follows:
$ oc adm release info quay.io/openshift-release-dev/ocp-release:4.4.3-x86_64
The image digest is sha256:039a4ef7c128a049ccf916a1d68ce93e8f5494b44d5a75df60c85e9e7191dacc
All OpenShift Container Platform 4.4 users are advised to upgrade to these
updated packages and images.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and `kubeadmin-password` files. Both files contain credentials used to authenticate to the OpenShift API server, and are incorrectly assigned word-readable permissions. ose-installer as shipped in Openshift 4.2 is vulnerable.
4.4 (Medium)
Affected products
Fixed
82 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-aws-machine-controllers@sha256:a18a10cf26ea63b98bcaf69634924a3b914f8ec31a6ecd63bc57cb1d71796831_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-azure-machine-controllers@sha256:ac080bae98b9d7dad20b81633e40e7d34a607f59e6d43a8d89964cdb5d5c0ae6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-baremetal-machine-controllers@sha256:3d3b44bc95a74ca374ce0b903ff3e45953203d354716159b6086759ae77dca04_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-baremetal-rhel7-operator@sha256:316a591ecd2ce90f98416f82ece37b09392f31a73bd93f9414df33d41690fe53_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cli-artifacts@sha256:5356aa09abc0761fea8dffadbbe2dd0d980d60be188e4508ea1a8c40f6665536_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cli@sha256:431ac8ceb82975a918467f6f2dd797cd5052b38f8de15ff7d144987cf8303093_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cloud-credential-operator@sha256:b5fb2b766c3cec3ec636e515dacc9748cb111c698b1982153794b5903014fbe7_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-authentication-operator@sha256:7ffe54d31d0b54fc05c8bfc3b602f407628cc89067f0680dab012b7b76e8bf33_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-autoscaler-operator@sha256:87b299fa93a0c5cf3b78cbfcda9dacce08f4177657491a46783e4f1b9825bf4e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-autoscaler@sha256:efbf390a4a19fb5837366d890ec44b2228ba00e12382c62f9954df6a3ecf4140_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-bootstrap@sha256:1a0960567869fae9f834b05d8b9cff8be68d9fd622bdcc31d14e74bb59bc6f85_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-config-operator@sha256:4d80b5036f917992a205089dec1371b3037b535ffa74f6e4e2d2922b22edd831_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-dns-operator@sha256:6ff957ed1aebe710163e5190b97f4bc41f6f44cb531e54c68a2f954eb58e63d4_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-image-registry-operator@sha256:64fa241e046004b872c5c05da1a1a2c041913b35c09e769c7104fc1b237e43e5_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-ingress-operator@sha256:47799a82ccaf85567c299934edb2174fd99e40570cbea20148c4e11e20339abb_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-kube-apiserver-operator@sha256:1716497ba22b107f22c4d80d7c1e15424aa171f0592dc764d39c0e54c7f5225e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-kube-controller-manager-operator@sha256:017494ad899a383a4b376df711343a0630d66da82be9b64816090da371e14874_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-kube-scheduler-operator@sha256:c94cdc5630d6bd40cf5206123961c905f37d02b08d7d112c33fdae967a195921_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-machine-approver@sha256:ec8b0be6168f174bf2b3af69b4542d3070cb96fe2642446387a51f97669bcd98_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-monitoring-operator@sha256:cdaafab234ef33a7bdab3907a42a79854357bc4f895ed10739864cb70d0b55b1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-network-operator@sha256:6784e6e4840d2ff28c06cd72309008ca8b1cfae3729b0a778aab3e16c768c830_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-node-tuning-operator@sha256:96479b22dc6b779adffff9786b8a0e74d9e12331ff913b9dd19dd1a11e4444ee_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-openshift-apiserver-operator@sha256:6073a158527b99e6bbdf9eac138f9cdb9e775613cb7912ddad88fa2c62b66507_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-openshift-controller-manager-operator@sha256:028ac0e29339fd5cb0e7236ea36c37dafe37e417a9d2290748ac85ddec9ba66a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-policy-controller-rhel7@sha256:278bd31ebef2498df26f75de59e5c7e5b63c6a1f0fb18704af64498f2483c837_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-samples-operator@sha256:aabf6016ecbb56313717d510b0de57389107463eedd35c967131b2aebc141037_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-storage-operator@sha256:79f7b4ee54216a5033693b652b7d6fbb6148f77d6a71d3d082599b56b5759719_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-update-keys@sha256:bfa34d076b2b2254219ab4f2bc2fea0964ba79233bbf84814e64af82c791a19e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-cluster-version-operator@sha256:56bdfb01c161ef38fba968612aefd136517825016142db2ff496471f221c6d59_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-configmap-reloader@sha256:1558c428be9c4e02b73ba186e6869ceed834036d16ef7adcce6215cce44c6d88_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-console-operator@sha256:dd2eaa6426514e280794510c0613fa54f59a32236a2520b3985c2f170583dab9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-console@sha256:52465443a0c0f8e1d9dd8f2e3c7ec0e5d32dc438f181adf467ab883a6b283c26_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-coredns@sha256:cdddb567722216da30d09e0b8ec533e7a60b827b01e26ecb61d32999366c4b94_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-csi-snapshot-controller-rhel7@sha256:aed066ffe6816e8e829108b9f61b79e67128f08746b2473d1bfb1dc4fb5bee77_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-csi-snapshot-controller@sha256:aed066ffe6816e8e829108b9f61b79e67128f08746b2473d1bfb1dc4fb5bee77_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-deployer@sha256:97222bce020dc00483db359bda48b35e9f0658555f165f8e6905ccd58927a79f_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-docker-builder@sha256:fb6534c3ba0fde7b41401d5d5d74e65ba1d56fd9d81bb837af0db454b3baea0c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-docker-registry@sha256:5e353fa33920b48a818a32b6746cde1029c3704d60b37350254906a293d61375_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-etcd@sha256:a8f9978516adb30da807b5b30551348223827419ad0666905a6f8792bf51462c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-grafana@sha256:1453f968c17301ae0b7e813fb7cbb47035d7cee7021d11daa043d8755622045b_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-haproxy-router@sha256:437b6cd81ccb4fc44d77904d1c2cbc3fceb95c96e0338b4f63b5577035f84a64_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-hyperkube@sha256:33db3709068675ca2420d4b5c0a101c27d03ead68d54a4ca958d17b60b3473dd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-installer-artifacts@sha256:d64e52dd94dd233ff69ffa6bd1b9bdcefdf13cbcfc0a9599c83369b03db5a899_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-installer@sha256:164339ac380e1fd2988c30bf1f190629170ce2f343b390c2c3e03116af5fa40c_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-jenkins-agent-maven@sha256:8b9f9051f61cc0a3dc8a69a79de7b3fd021c062fdfa4f120a192dd2a4aaf6c21_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-jenkins@sha256:818ded53e8e91bc7df9afa41e5b922336a60546d8ea9389ab685ab67402eeed4_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-k8s-prometheus-adapter@sha256:8ca36e7f57812f5bc7d8ba024a2866f2fa3382491d2eb45fd0ca36b6c0db0f64_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-keepalived-ipfailover@sha256:6866ac24a9ed075c606a0655e5280948035a0a9e685b541dabdd92400eef1a6d_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-kube-proxy@sha256:6cfbb50ff919c0ca9c06dea1ba40a9646d055d56a2e8737d31823b26ba8cbfec_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-kube-rbac-proxy@sha256:a91d8c8f946f7726964b691ed89cdfa1ef94490ddfb20f039a4748e088f4758a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-kube-state-metrics@sha256:c0e62e8d66ea996de4eb8e922daa0a9e5a353d9ed347dcf6d31a785fe491a3ba_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-libvirt-machine-controllers@sha256:534d8e7732d976b30288d3a740d0222c7cf8b431cdd539e5f401d6f39a7f55db_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-local-storage-static-provisioner@sha256:05650b003e27e5bb155b1a8847486fc18c6196e55910873f71ddb09f456d52fd_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-machine-api-operator@sha256:6a990ba086c6e878a621213d85b116476b327b93758518a62ff95cbfc6451ca8_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-machine-config-operator@sha256:a9610c9325ae9e95aeb4c55654402ab0722288e49b26808be8d0ec57ff1072b3_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-multus-admission-controller@sha256:292e6693e8bc658f71d9e212108f0c76f38ef2c3347d1b350339d021b0fac317_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-multus-cni@sha256:bc4a49a0158c44ac7b3b1c8e887744747c371e89e5b615752e077996b05da641_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-must-gather@sha256:6326b78d6c05d9925576ae8c6768f7ee846b8e99618da670b5e7b698e1dd433a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-oauth-proxy@sha256:1d5825577014d40e186d14a477d556f2a8a407e699efaad006be21eae93eb1f6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-openstack-machine-controllers@sha256:fca7516fdbca057bc93e2493a8be172ef3402dedbabaab2e8b292705ffd85b4f_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-operator-lifecycle-manager@sha256:1820d48c2be6380b5f52cf48dd5c45c8dff7e91f60ff73ec8bebe6c57d3baf8a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-operator-marketplace@sha256:9cdb75fb317a9e2168a4f8d96b3559c3165e294e5d9249f9fb09b6c67996b0e3_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-operator-registry@sha256:3b51c198ffca2f63bf3ae4130810137e4c3a1dcc4c85d73ae739ef7653c367ce_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-ovn-kubernetes@sha256:fd1300fa1c375d4089380316a292375dac9e7a148c6cd4a5d1487ec7af5dcab0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-pod@sha256:1428f0d9146362d35d6bced979aca00a669ef89903014b0764b5191c18da5ff0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-prom-label-proxy@sha256:84868023c1ce5d786b9e459f9876ea861c3f81befc8bf124eebe984688bbe6e4_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-prometheus-alertmanager@sha256:59e2a6c168b65b1018668775858925b5d89711a09bb13441a9a9b5e24d257ec1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-prometheus-config-reloader@sha256:affd15c268879bd09f291679f9bab194ea0ed606801f68ab460bed5fa34cbb0e_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-prometheus-node-exporter@sha256:974a0e99e84ef4aaf277a1b4dea0cb37627ca38803300745bca89fdb0874bf2a_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-prometheus-operator@sha256:6a5398997bd7ccddd8d0be0f0f2d9dcae8dddc01d54e6877437f07397c273048_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-prometheus@sha256:e3eb0ba6a52c3e8cf07b7fabb81c17c91fe703562f1635d4cf877da78ebe8420_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-service-ca-operator@sha256:8205d3d34e9ec869557021918d5ece8a0c896f9d96363261d5390ac19ed16319_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-telemeter@sha256:1a6483a75a4029c36769a8b4b46e99146f895a840bd14d138a0db7dcb2479c93_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 7Server-RH7-RHOSE-4.4:openshift4/ose-tests@sha256:ab80aad7b39ad5f1f9d3107560d7367aae144fff3a3596a6d972f481db4805af_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.4:openshift4/ose-ironic-hardware-inventory-recorder-rhel8@sha256:93c5a4c6c073c8c1c63eb8379f7fa65628cfed09a92f62105e8e8f6f8aafee34_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.4:openshift4/ose-ironic-inspector-rhel8@sha256:631248b90c642607532cf903811122b4805a029c522d911ffd9f937b841542a6_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.4:openshift4/ose-ironic-ipa-downloader-rhel8@sha256:d5c34bd4be983d0f3cbdbd34a1f27f38064d82ec618c200fd775c8aaff1d76c8_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.4:openshift4/ose-ironic-machine-os-downloader-rhel8@sha256:2dab0ffd97c1df4b431acdb7d13449f9a966a84602712186a74b58db0a9dff9f_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.4:openshift4/ose-ironic-rhel8@sha256:fb91cdeb7cb1814cc8a04445025d2fa5c88095f675042366b3606d9ad9ff28f9_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.4:openshift4/ose-ironic-static-ip-manager-rhel8@sha256:d2ba05a7a0a0d82e8a47b7234f40322a9eef9607060baf5b5b88b88d4c302a87_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.4:openshift4/ose-kuryr-cni-rhel8@sha256:0bdff397b182fa36752070124e3b459ab5d04c6d97e4cdd729f11c88aa3f320f_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: 8Base-RHOSE-4.4:openshift4/ose-kuryr-controller-rhel8@sha256:a2f1f87c516993334fd8f1a126d3a06e5bdcc71eb06edb229271fe9944256932_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Low
An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
7.0 (High)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Moderate
An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
7.0 (High)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Moderate
A flaw was found in runc. An attacker who controls the container image for two containers that share a volume can race volume mounts during container initialization, by adding a symlink to the rootfs that points to a directory on the volume. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
7.0 (High)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Moderate
A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.
5.9 (Medium)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Low
A flaw was found in Jenkins. Encryption key parameters are improperly reused in the Inbound TCP Agent Protocol/3 allowing unauthorized attackers with knowledge of agent names to obtain the connection secrets for those agents. The highest threat from this vulnerability is to data confidentiality.
8.6 (High)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Important
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier was vulnerable to a UDP amplification reflection denial of service attack on port 33848.
5.8 (Medium)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Moderate
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier did not use a constant-time comparison function for validating connection secrets, which could potentially allow an attacker to use a timing attack to obtain this secret.
5.3 (Medium)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Moderate
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier used a non-constant time comparison function when validating an HMAC.
5.3 (Medium)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Moderate
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier exposed session identifiers on a user's detail object in the whoAmI diagnostic page.
4.4 (Medium)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Moderate
Jenkins 2.218 and earlier, LTS 2.204.1 and earlier allowed users with Overall/Read access to view a JVM memory usage chart.
4.3 (Medium)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Low
REST API endpoints in Jenkins 2.218 and earlier, LTS 2.204.1 and earlier were vulnerable to clickjacking attacks.
CWE-1021 - Improper Restriction of Rendered UI Layers or FramesAffected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Low
A denial of service flaw was found in Kubernetes' Kubelet API. A remote attacker can exploit this flaw by sending repeated, crafted HTTP requests to exhaust available memory and cause a crash.
4.3 (Medium)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Moderate
A denial of service vulnerability was found in the Kubernetes API server. This flaw allows a remote attacker to send repeated, crafted HTTP requests to exhaust available memory and cause a crash.
4.3 (Medium)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Moderate
A use-after-free vulnerability was found in the Go GPGME wrapper library, github.com/proglottis/gpgme. An attacker could use this flaw to crash or cause potential code execution in Go applications that use this library, under certain conditions, during GPG signature verification.
7.5 (High)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Moderate
A path traversal flaw was found in Buildah. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.
8.8 (High)
Affected products
Fixed
82 products, the same list as for
CVE-2019-19335
Threats
Impact
Low
References
1622 references
Loading 1.0 MB of JSON…
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.