SB2019121117 - Multiple vulnerabilities in Red Hat OpenShift Container Platform
Published: December 11, 2019
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Cleartext storage of sensitive information (CVE-ID: CVE-2019-14854)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to library-go component did not sanitize secret data written to static Pod logs when an Operator's log level was set to Debug or higher. A local user can read Pod logs if the log level had already been modified in an Operator by a privileged user.
2) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-10431)
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to the sandbox protection in the affected plugin can be circumvented through default parameter expressions in constructors. A remote authenticated attacker can specify and run sandboxed scripts to execute arbitrary code in the context of the Jenkins master JVM.
3) Stored cross-site scripting (CVE-ID: CVE-2019-10432)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to the affected plugin does not escape the project or build display name shown in the frame HTML page. A remote authenticated attacker who is able to control the project or build display name, typically users with Job/Configure or Build/Update permission can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
4) Input validation error (CVE-ID: CVE-2019-11255)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied input in Kubernetes CSI sidecar containers for external-provisioner (versions prior to 0.4.3 and 1.0.2, in version 1.1, and versions prior to 1.2.2 and 1.3.1), external-snapshotter (versions prior to 0.4.2 and 1.0.2, in version 1.1, versions prior to 1.2.2), and external-resizer (versions 0.1, and 0.2) . A local user can gain unauthorized PersistentVolume data access or volume mutation during snapshot, restore from snapshot, cloning and resizing operations.
Remediation
Install update from vendor's website.