RHEA-2020:2011
Vulnerability from csaf_redhat - Published: 2020-05-04 19:09 - Updated: 2025-11-21 17:24Summary
Red Hat Enhancement Advisory: CNV 2.3.0 Images
Severity
Moderate
Notes
Topic: Container-native virtualization release 2.3.0 is now available with updates to packages and images that fix several bugs and add enhancements.
Details: Container-native virtualization is Red Hat's virtualization solution designed for Red Hat OpenShift Container Platform.
This advisory contains the following container-native virtualization 2.3.0 images:
RHEL-7-CNV-2.3
==============
kubevirt-ssp-operator-container-v2.3.0-42
RHEL-8-CNV-2.3
==============
hostpath-provisioner-operator-container-v2.3.0-13
kubevirt-cpu-node-labeller-container-v2.3.0-9
kubevirt-metrics-collector-container-v2.3.0-9
kubevirt-template-validator-container-v2.3.0-10
virtio-win-container-v2.3.0-8
node-maintenance-operator-container-v2.3.0-10
hostpath-provisioner-container-v2.3.0-12
kubevirt-kvm-info-nfd-plugin-container-v2.3.0-9
bridge-marker-container-v2.3.0-29
cnv-containernetworking-plugins-container-v2.3.0-30
kubemacpool-container-v2.3.0-28
kubevirt-cpu-model-nfd-plugin-container-v2.3.0-9
kubernetes-nmstate-handler-container-v2.3.0-30
ovs-cni-marker-container-v2.3.0-29
cluster-network-addons-operator-container-v2.3.0-28
ovs-cni-plugin-container-v2.3.0-28
kubevirt-v2v-conversion-container-v2.3.0-11
kubevirt-vmware-container-v2.3.0-11
virt-operator-container-v2.3.0-39
virt-controller-container-v2.3.0-39
virt-handler-container-v2.3.0-39
virt-api-container-v2.3.0-39
virt-launcher-container-v2.3.0-39
virt-cdi-cloner-container-v2.3.0-41
virt-cdi-operator-container-v2.3.0-41
virt-cdi-apiserver-container-v2.3.0-41
virt-cdi-uploadproxy-container-v2.3.0-41
virt-cdi-controller-container-v2.3.0-41
virt-cdi-importer-container-v2.3.0-41
virt-cdi-uploadserver-container-v2.3.0-41
hyperconverged-cluster-operator-container-v2.3.0-61
cnv-must-gather-container-v2.3.0-45
hco-bundle-registry-container-v2.3.0-174
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the KubeVirt main virt-handler regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret.
6.5 (Medium)
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHEA-2020:2011
Workaround
This issue can only be resolved by applying updates.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
7.0 (High)
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHEA-2020:2011
References
Acknowledgments
SPR Inc.
Joseph LaMagna-Reiter
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Container-native virtualization release 2.3.0 is now available with updates to packages and images that fix several bugs and add enhancements.",
"title": "Topic"
},
{
"category": "general",
"text": "Container-native virtualization is Red Hat\u0027s virtualization solution designed for Red Hat OpenShift Container Platform.\n\nThis advisory contains the following container-native virtualization 2.3.0 images:\n\nRHEL-7-CNV-2.3\n==============\nkubevirt-ssp-operator-container-v2.3.0-42\n\nRHEL-8-CNV-2.3\n==============\nhostpath-provisioner-operator-container-v2.3.0-13\nkubevirt-cpu-node-labeller-container-v2.3.0-9\nkubevirt-metrics-collector-container-v2.3.0-9\nkubevirt-template-validator-container-v2.3.0-10\nvirtio-win-container-v2.3.0-8\nnode-maintenance-operator-container-v2.3.0-10\nhostpath-provisioner-container-v2.3.0-12\nkubevirt-kvm-info-nfd-plugin-container-v2.3.0-9\nbridge-marker-container-v2.3.0-29\ncnv-containernetworking-plugins-container-v2.3.0-30\nkubemacpool-container-v2.3.0-28\nkubevirt-cpu-model-nfd-plugin-container-v2.3.0-9\nkubernetes-nmstate-handler-container-v2.3.0-30\novs-cni-marker-container-v2.3.0-29\ncluster-network-addons-operator-container-v2.3.0-28\novs-cni-plugin-container-v2.3.0-28\nkubevirt-v2v-conversion-container-v2.3.0-11\nkubevirt-vmware-container-v2.3.0-11\nvirt-operator-container-v2.3.0-39\nvirt-controller-container-v2.3.0-39\nvirt-handler-container-v2.3.0-39\nvirt-api-container-v2.3.0-39\nvirt-launcher-container-v2.3.0-39\nvirt-cdi-cloner-container-v2.3.0-41\nvirt-cdi-operator-container-v2.3.0-41\nvirt-cdi-apiserver-container-v2.3.0-41\nvirt-cdi-uploadproxy-container-v2.3.0-41\nvirt-cdi-controller-container-v2.3.0-41\nvirt-cdi-importer-container-v2.3.0-41\nvirt-cdi-uploadserver-container-v2.3.0-41\nhyperconverged-cluster-operator-container-v2.3.0-61\ncnv-must-gather-container-v2.3.0-45\nhco-bundle-registry-container-v2.3.0-174",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHEA-2020:2011",
"url": "https://access.redhat.com/errata/RHEA-2020:2011"
},
{
"category": "external",
"summary": "1712429",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712429"
},
{
"category": "external",
"summary": "1713378",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713378"
},
{
"category": "external",
"summary": "1722850",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1722850"
},
{
"category": "external",
"summary": "1729761",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1729761"
},
{
"category": "external",
"summary": "1739149",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1739149"
},
{
"category": "external",
"summary": "1745998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1745998"
},
{
"category": "external",
"summary": "1753243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1753243"
},
{
"category": "external",
"summary": "1757784",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1757784"
},
{
"category": "external",
"summary": "1765221",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1765221"
},
{
"category": "external",
"summary": "1769593",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1769593"
},
{
"category": "external",
"summary": "1769595",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1769595"
},
{
"category": "external",
"summary": "1770339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1770339"
},
{
"category": "external",
"summary": "1781293",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1781293"
},
{
"category": "external",
"summary": "1781512",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1781512"
},
{
"category": "external",
"summary": "1782241",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1782241"
},
{
"category": "external",
"summary": "1783343",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1783343"
},
{
"category": "external",
"summary": "1789093",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1789093"
},
{
"category": "external",
"summary": "1793603",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1793603"
},
{
"category": "external",
"summary": "1794050",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1794050"
},
{
"category": "external",
"summary": "1795227",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1795227"
},
{
"category": "external",
"summary": "1796796",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1796796"
},
{
"category": "external",
"summary": "1798487",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1798487"
},
{
"category": "external",
"summary": "1799016",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1799016"
},
{
"category": "external",
"summary": "1799055",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1799055"
},
{
"category": "external",
"summary": "1800714",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1800714"
},
{
"category": "external",
"summary": "1800792",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1800792"
},
{
"category": "external",
"summary": "1801297",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801297"
},
{
"category": "external",
"summary": "1802001",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802001"
},
{
"category": "external",
"summary": "1802120",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802120"
},
{
"category": "external",
"summary": "1802126",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802126"
},
{
"category": "external",
"summary": "1803220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1803220"
},
{
"category": "external",
"summary": "1804102",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1804102"
},
{
"category": "external",
"summary": "1805204",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805204"
},
{
"category": "external",
"summary": "1805627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805627"
},
{
"category": "external",
"summary": "1806115",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1806115"
},
{
"category": "external",
"summary": "1807572",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1807572"
},
{
"category": "external",
"summary": "1807804",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1807804"
},
{
"category": "external",
"summary": "1807820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1807820"
},
{
"category": "external",
"summary": "1809872",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1809872"
},
{
"category": "external",
"summary": "1810493",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1810493"
},
{
"category": "external",
"summary": "1812710",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1812710"
},
{
"category": "external",
"summary": "1812856",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1812856"
},
{
"category": "external",
"summary": "1812970",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1812970"
},
{
"category": "external",
"summary": "1813106",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813106"
},
{
"category": "external",
"summary": "1813350",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813350"
},
{
"category": "external",
"summary": "1815145",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1815145"
},
{
"category": "external",
"summary": "1816778",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816778"
},
{
"category": "external",
"summary": "1817057",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1817057"
},
{
"category": "external",
"summary": "1819288",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819288"
},
{
"category": "external",
"summary": "1819700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819700"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhea-2020_2011.json"
}
],
"title": "Red Hat Enhancement Advisory: CNV 2.3.0 Images",
"tracking": {
"current_release_date": "2025-11-21T17:24:20+00:00",
"generator": {
"date": "2025-11-21T17:24:20+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.12"
}
},
"id": "RHEA-2020:2011",
"initial_release_date": "2020-05-04T19:09:59+00:00",
"revision_history": [
{
"date": "2020-05-04T19:09:59+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-05-04T19:09:59+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-11-21T17:24:20+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "CNV 2.3 for RHEL 8",
"product": {
"name": "CNV 2.3 for RHEL 8",
"product_id": "8Base-CNV-2.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:container_native_virtualization:2.3::el8"
}
}
}
],
"category": "product_family",
"name": "OpenShift Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64",
"product_id": "container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-cpu-model-nfd-plugin\u0026tag=v2.3.0-9"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64",
"product_id": "container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-cpu-node-labeller\u0026tag=v2.3.0-9"
}
}
},
{
"category": "product_version",
"name": "container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64",
"product": {
"name": "container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64",
"product_id": "container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7?arch=amd64\u0026repository_url=registry.redhat.io/container-native-virtualization/kubevirt-kvm-info-nfd-plugin\u0026tag=v2.3.0-9"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64 as a component of CNV 2.3 for RHEL 8",
"product_id": "8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64",
"relates_to_product_reference": "8Base-CNV-2.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64 as a component of CNV 2.3 for RHEL 8",
"product_id": "8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64",
"relates_to_product_reference": "8Base-CNV-2.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64 as a component of CNV 2.3 for RHEL 8",
"product_id": "8Base-CNV-2.3:container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64"
},
"product_reference": "container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64",
"relates_to_product_reference": "8Base-CNV-2.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-1701",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"discovery_date": "2020-01-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1792092"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the KubeVirt main virt-handler regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "virt-handler: virt-handler daemonset clusterroles allows retrieval of secrets",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1701"
},
{
"category": "external",
"summary": "RHBZ#1792092",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1792092"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1701",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1701"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1701",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1701"
}
],
"release_date": "2020-01-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-04T19:09:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHEA-2020:2011"
},
{
"category": "workaround",
"details": "This issue can only be resolved by applying updates.\nMitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "virt-handler: virt-handler daemonset clusterroles allows retrieval of secrets"
},
{
"acknowledgments": [
{
"names": [
"Joseph LaMagna-Reiter"
],
"organization": "SPR Inc."
}
],
"cve": "CVE-2020-1742",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"discovery_date": "2019-11-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1803608"
}
],
"notes": [
{
"category": "description",
"text": "An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nmstate/kubernetes-nmstate-handler: /etc/passwd is given incorrect privileges",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "By default this vulnerability is not exploitable in un-privilieged containers running on OpenShift Container Platform. This is because the system call SETUID and SETGID is blocked by the default seccomp policy.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1742"
},
{
"category": "external",
"summary": "RHBZ#1803608",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1803608"
},
{
"category": "external",
"summary": "RHSB-4859371",
"url": "https://access.redhat.com/articles/4859371"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1742",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1742"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1742",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1742"
}
],
"release_date": "2020-01-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-05-04T19:09:59+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHEA-2020:2011"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-model-nfd-plugin@sha256:6205bf74b2bbfceea280c45f465353f0f9e6d8f7087667fc6d069f097794dd2c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-cpu-node-labeller@sha256:de06c0fa6a20baea78d05437d5da51690902c93ab7707a4a425c38f67d634d3c_amd64",
"8Base-CNV-2.3:container-native-virtualization/kubevirt-kvm-info-nfd-plugin@sha256:c491da3af303a528ef73124a6c55dfb4cb34f7dee41727055ca268a30c6d18e7_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nmstate/kubernetes-nmstate-handler: /etc/passwd is given incorrect privileges"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…