CVE-2019-10150 — Improper Authentication in Redhat Openshift Container Platform

CWE-287 — Improper Authentication6 documents5 sources
Severity
5.9MEDIUMNVD
EPSS
0.3%
top 46.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Redhat Openshift Container PlatformRedhat Atomic-openshift
Timeline
PublishedJun 12
Latest updateMay 24

Description

It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5redhat/atomic-openshift3.6.x - 4.0.0

🔴Vulnerability Details

2
GHSA
GHSA-ccwq-5269-25p2: It was found that OpenShift Container Platform versions 3↗2022-05-24
▶
CVEList
CVE-2019-10150: It was found that OpenShift Container Platform versions 3↗2019-06-12
▶

📋Vendor Advisories

1
Red Hat
atomic-openshift: OpenShift builds don't verify SSH Host Keys for the git repository↗2019-05-29
▶

💬Community

2
Bugzilla
CVE-2019-10150 origin: atomic-openshift: OpenShift builds don't verify SSH Host Keys for the git repository [fedora-all]↗2019-05-30
▶
Bugzilla
CVE-2019-10150 atomic-openshift: OpenShift builds don't verify SSH Host Keys for the git repository↗2019-05-23
▶
CVE-2019-10150 — Improper Authentication in Redhat | cvebase