SB2020031116 - Multiple vulnerabilities in OpenShift Container Platform

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020031116

SB2020031116 - Multiple vulnerabilities in OpenShift Container Platform

Published: March 11, 2020 Updated: March 17, 2020

Security Bulletin ID SB2020031116
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper access control (CVE-ID: CVE-2019-19921)

The vulnerability allows a local user to gain unauthorized access to sensitive information.

The vulnerability exists due to improper access restrictions, related to libcontainer/rootfs_linux.go in runc. A local user with ability to spawn two containers with custom volume-mount configurations, and run custom images can escalate privileges on the system.


2) Use-after-free (CVE-ID: CVE-2020-8945)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error, as demonstrated by use for container image pulls by Docker or CRI-O. A remote attacker can crash the target system, or cause potential code execution for Go applications that use this library under certain conditions during GPG signature verification.


Remediation

Install update from vendor's website.

References