CVE-2019-11244

kubectl creates world-writeable cached schema files

In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.

CVSS 3.1 · 5.0 Medium EPSS < 1% KEV · Not listed

Vendors

Kubernetes Netapp Redhat

Products

Kubernetes Trident Openshift and 1 more

CVE-2019-10384

jenkins: CSRF protection tokens for anonymous users did not expire in some circumstances (SECURITY-1491)

Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed users to obtain CSRF tokens without an associated web session ID, resulting in CSRF tokens that did not expire and could be used to bypass CSRF protection for the anonymous user.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Jenkins Oracle Redhat

Products

Jenkins Communications Cloud Native Core Automated Test Suite Openshift and 1 more

CVE-2019-10383

jenkins: stored cross-site scripting in update center web pages (SECURITY-1453)

A stored cross-site scripting vulnerability in Jenkins 2.191 and earlier, LTS 2.176.2 and earlier allowed attackers with Overall/Administer permission to configure the update site URL to inject arbitrary HTML and JavaScript in update center web pages.

CVSS 3.1 · 4.8 Medium EPSS 1.4% KEV · Not listed

Vendors

Jenkins Oracle Redhat

Products

Jenkins Communications Cloud Native Core Automated Test Suite Openshift and 1 more

CVE-2019-10357

jenkins-plugin-workflow-cps-global-lib: Missing permission check in Pipeline: Shared Groovy Libraries Plugin

A missing permission check in Jenkins Pipeline: Shared Groovy Libraries Plugin 2.14 and earlier allowed users with Overall/Read access to obtain limited information about the content of SCM repositories referenced by global libraries.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Jenkins Redhat

Products

Pipeline\ Openshift Openshift Container Platform

CVE-2019-10356

jenkins-plugin-script-security: Sandbox bypass through method pointer expressions in Script Security Plugin

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of method pointer expressions allowed attackers to execute arbitrary code in sandboxed scripts.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift Openshift Container Platform

CVE-2019-10355

jenkins-plugin-script-security: Sandbox bypass through type casts in Script Security Plugin

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.61 and earlier related to the handling of type casts allowed attackers to execute arbitrary code in sandboxed scripts.

CVSS 3.1 · 8.8 High EPSS 2.5% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift Openshift Container Platform

CVE-2019-10354

jenkins: Unauthorized view fragment access (SECURITY-534)

A vulnerability in the Stapler web framework used in Jenkins 2.185 and earlier, LTS 2.176.1 and earlier allowed attackers to access view fragments directly, bypassing permission checks and possibly obtain sensitive information.

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Jenkins Redhat

Products

Jenkins Openshift Openshift Container Platform

CVE-2019-10225

atomic-openshift: The basic-user RBAC role allow leaking of GlusterFS StorageClass restuserkey value

A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and use it to authenticate to the GlusterFS REST service, gaining access to read, and modify files.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2019-10223

kube-state-metrics: annotations exposed as metrics in combination with `kubectl` can allow for exposure of secrets

A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exposing the secret content in metrics. This feature has been reverted and released as the v1.7.2 release. If you are running the v1.7.0 or v1.7.1 release, please upgrade to the v1.7.2 release as soon as possible.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Kubernetes Linux Redhat

Products

Kube-state-metrics Linux Kernel Openshift Container Platform

CVE-2019-10214

containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.

CVSS 3.1 · 5.9 Medium EPSS 1.6% KEV · Not listed

Vendors

Buildah Project Libpod Project Opensuse and 2 more

Products

Buildah Libpod Leap and 4 more

CVE-2019-10213

openshift: Secret data written to pod logs when operator set at Debug level or higher

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Openshift Container Platform

CVE-2019-10200

openshift: Users with permission to schedule pods on master nodes can access credentials for AWS IAM roles

A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS IAM role, allowing management access to AWS resources. With access to the security credentials, the user then has access to the entire infrastructure. Impact to data and system availability is high.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Openshift Container Platform

CVE-2019-10176

atomic-openshift: CSRF tokens not refreshing while user is logged in and are exposed in the URL

A flaw was found in OpenShift Container Platform, versions 3.11 and later, in which the CSRF tokens used in the cluster console component were found to remain static during a user's session. An attacker with the ability to observe the value of this token would be able to re-use the token to perform a CSRF attack.

CVSS 3.0 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2019-10165

openshift: OAuth access tokens written in plaintext to API server audit logs

OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenShift API server. A user with sufficient privileges could recover OAuth tokens from these audit logs and use them to access other resources.

CVSS 3.1 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2019-10150

atomic-openshift: OpenShift builds don't verify SSH Host Keys for the git repository

It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.

CVSS 3.0 · 5.9 Medium EPSS 1.4% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2019-1010238

pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

CVSS 3.1 · 9.8 Critical EPSS 6.3% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 11 more

CVE-2019-1003050

jenkins: Improper escaping of job URLs in f:validateButton leads to cross-site scripting vulnerability.

The f:validateButton form control for the Jenkins UI did not properly escape job URLs in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, resulting in a cross-site scripting (XSS) vulnerability exploitable by users with the ability to control job names.

CVSS 3.1 · 5.4 Medium EPSS 1.3% KEV · Not listed

Vendors

Jenkins Oracle Redhat

Products

Jenkins Communications Cloud Native Core Automated Test Suite Openshift and 1 more

CVE-2019-1003049

jenkins: Jenkins accepted cached legacy CLI authentication

Users who cached their CLI authentication before Jenkins was updated to 2.150.2 and newer, or 2.160 and newer, would remain authenticated in Jenkins 2.171 and earlier and Jenkins LTS 2.164.1 and earlier, because the fix for CVE-2019-1003004 in these releases did not reject existing remoting-based CLI authentication caches.

CVSS 3.1 · 8.1 High EPSS 2.1% KEV · Not listed

Vendors

Jenkins Oracle Redhat

Products

Jenkins Communications Cloud Native Core Automated Test Suite Openshift and 1 more

CVE-2019-1003041

jenkins-plugin-workflow-cps: Sandbox bypass in Script Security Plugin and Pipeline: Groovy Plugin (SECURITY-1353)

A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

CVSS 3.1 · 9.8 Critical EPSS 3.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Pipeline\ Openshift Openshift Container Platform

CVE-2019-1003040

jenkins-plugin-script-security: Sandbox bypass in Script Security Plugin and Pipeline: Groovy Plugin (SECURITY-1353)

A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

CVSS 3.1 · 9.8 Critical EPSS 3.4% KEV · Not listed

Vendors

Jenkins Redhat

Products

Script Security Openshift Openshift Container Platform