vulnwire
5.9med

CVE-2019-10150

It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authenticat…

Published 7 y ago · modified 4 mo ago · JSON

CVSS
5.9
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.4%
percentile 72%
Public exploits
0
none known

It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.

Exploit prediction (EPSS)

1.39% probability of exploitation in the next 30 days, higher than 72% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.05.9CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
CNA3.05.9CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
NVD3.05.9CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • redhat atomic-openshift

Classification

Weakness

References

  • docs.openshift.com /container-platform/3.11/dev_guide/builds/build_inputs.html#source-secrets-ssh-key-authent · x_refsource_MISC, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10150 · x_refsource_CONFIRM, x_transferred
  • access.redhat.com /errata/RHSA-2019:2989 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:3007 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:3143 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • access.redhat.com /errata/RHSA-2019:3811 · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.