CVE-2019-10328

jenkins-plugin-workflow-remote-loader: Unsafe Script Security whitelist entry in Pipeline Remote Loader Plugin (SECURITY-921)

Jenkins Pipeline Remote Loader Plugin 1.4 and earlier provided a custom whitelist for script security that allowed attackers to invoke arbitrary methods, bypassing typical sandbox protection.

CVSS 3.0 · 9.9 Critical EPSS 1.9% KEV · Not listed

Vendors

Jenkins Redhat

Products

Pipeline Remote Loader Openshift

CVE-2019-10320

jenkins-credentials-plugin: Certificate file read vulnerability in Credentials Plugin (SECURITY-1322)

Jenkins Credentials Plugin 2.1.18 and earlier allowed users with permission to create or update credentials to confirm the existence of files on the Jenkins master with an attacker-specified path, and obtain the certificate content of files containing a PKCS#12 certificate.

CVSS 3.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jenkins Redhat

Products

Credentials Openshift

CVE-2019-10247

jetty: error path information disclosure

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it presents the various configured contexts as HTML for users to click through to. This produced HTML includes output that contains the configured fully qualified directory base resource location for each context.

CVSS 3.1 · 5.3 Medium EPSS 5.9% KEV · Not listed

Vendors

Debian Eclipse Netapp and 2 more

Products

Debian Linux Jetty Element and 25 more

CVE-2019-10245

JDK: Read beyond the end of bytecode array causing JVM crash

In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes. Eclipse OpenJ9 v0.14.0 correctly detects this case and rejects the attempted class load.

CVSS 3.1 · 7.5 High EPSS 2.5% KEV · Not listed

Vendors

Eclipse Redhat

Products

Openj9 Enterprise Linux Enterprise Linux Desktop and 5 more

CVE-2019-10241

jetty: using specially formatted URL against DefaultServlet or ResourceHandler leads to XSS conditions

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

CVSS 3.1 · 6.1 Medium EPSS 9.4% KEV · Not listed

Vendors

Apache Debian Eclipse and 2 more

Products

Activemq Drill Debian Linux and 6 more

CVE-2019-10225

atomic-openshift: The basic-user RBAC role allow leaking of GlusterFS StorageClass restuserkey value

A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and use it to authenticate to the GlusterFS REST service, gaining access to read, and modify files.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2019-10224

389-ds-base: using dscreate in verbose mode results in information disclosure

A flaw has been found in 389-ds-base versions 1.4.x.x before 1.4.1.3. When executed in verbose mode, the dscreate and dsconf commands may display sensitive information, such as the Directory Manager password. An attacker, able to see the screen or record the terminal standard error output, could use this flaw to gain sensitive information.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

389 Directory Server Enterprise Linux

CVE-2019-10223

kube-state-metrics: annotations exposed as metrics in combination with `kubectl` can allow for exposure of secrets

A security issue was discovered in the kube-state-metrics versions v1.7.0 and v1.7.1. An experimental feature was added to the v1.7.0 release that enabled annotations to be exposed as metrics. By default, the kube-state-metrics metrics only expose metadata about Secrets. However, a combination of the default `kubectl` behavior and this new feature can cause the entire secret content to end up in metric labels thus inadvertently exposing the secret content in metrics. This feature has been reverted and released as the v1.7.2 release. If you are running the v1.7.0 or v1.7.1 release, please upgrade to the v1.7.2 release as soon as possible.

CVSS 3.1 · 6.5 Medium EPSS 1.8% KEV · Not listed

Vendors

Kubernetes Linux Redhat

Products

Kube-state-metrics Linux Kernel Openshift Container Platform

CVE-2019-10221

pki-core: Reflected XSS in getcookies?url= endpoint in CA

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.

CVSS 3.1 · 4.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Dogtagpki Redhat

Products

Dogtagpki Enterprise Linux Rhel Eus

CVE-2019-10218

samba: smb client vulnerable to filenames containing path separators

A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators. This could allow the client to access files and folders outside of the SMB network pathnames. An attacker could use this vulnerability to create files outside of the current working directory using the privileges of the client user.

CVSS 3.1 · 6.5 Medium EPSS 3.4% KEV · Not listed

Vendors

Fedoraproject Redhat Samba

Products

Fedora Enterprise Linux Storage and 1 more

CVE-2019-10217

Ansible: gcp modules do not flag sensitive data fields properly

A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Redhat

Products

Ansible Ansible Engine

CVE-2019-10216

ghostscript: -dSAFER escape via .buildfont1 (701394)

In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could escalate privileges and access files outside of restricted areas.

CVSS 3.1 · 7.8 High EPSS 2.3% KEV · Not listed

Vendors

Artifex Redhat

Products

Ghostscript 3scale Amp 3scale Api Management and 7 more

CVE-2019-10215

bootstrap3-typeahead.js: Cross-site scripting via highlighter() function

Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could exploit this via user interaction to execute code in the user's browser.

CVSS 3.1 · 6.1 Medium EPSS 1.5% KEV · Not listed

Vendors

Bootstrap-3-typeahead Project Redhat

Products

Bootstrap-3-typeahead Openshift

CVE-2019-10214

containers/image: not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.

CVSS 3.1 · 5.9 Medium EPSS 1.6% KEV · Not listed

Vendors

Buildah Project Libpod Project Opensuse and 2 more

Products

Buildah Libpod Leap and 4 more

CVE-2019-10213

openshift: Secret data written to pod logs when operator set at Debug level or higher

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Openshift Container Platform

CVE-2019-10212

undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this flaw to obtain the user's credentials from the log files.

CVSS 3.1 · 9.8 Critical EPSS 1.9% KEV · Not listed

Vendors

Netapp Redhat

Products

Active Iq Unified Manager Enterprise Linux Jboss Data Grid and 6 more

CVE-2019-10208

postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution

A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where arbitrary SQL statements can be executed given a suitable SECURITY DEFINER function. An attacker, with EXECUTE permission on the function, can execute arbitrary SQL as the owner of the function.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed

Vendors

Postgresql Redhat

Products

Postgresql Enterprise Linux Rhel E4s and 2 more

CVE-2019-10207

kernel: null-pointer dereference in hci_uart_set_flow_control

A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attacker with local access and write permissions to the Bluetooth hardware could use this flaw to issue a specially crafted ioctl function call and cause the system to crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Extras Rt

CVE-2019-10206

Ansible: disclosure data when prompted for password and template characters are passed

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Opensuse Redhat

Products

Debian Linux Backports Sle Leap and 3 more

CVE-2019-10205

quay: Red Hat Quay stores robot account tokens in plain text

A flaw was found in the way Red Hat Quay stores robot account tokens in plain text. An attacker able to perform database queries in the Red Hat Quay database could use the tokens to read or write container images stored in the registry.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Quay