CVE-2019-14854 — Improper Output Neutralization for Logs in Redhat Openshift Container Platform

CWE-117 — Improper Output Neutralization for Logs CWE-532 — Log File Information Exposure5 documents5 sources

Severity

6.5MEDIUMNVD

EPSS

0.3%

top 42.95%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

RED HAT Library-go Redhat Openshift Container Platform

Timeline

PublishedJan 7

Latest updateMay 24

Description

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages1 packages

▶CVEListV5red_hat/library-goAs shipped with Openshift 4.x

Also affects: Openshift Container Platform 4.1, 4.2

🔴Vulnerability Details

GHSA

GHSA-rcxj-gjxv-rf5c: OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or high↗2022-05-24

▶

CVEList

CVE-2019-14854: OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or high↗2020-01-07

▶

📋Vendor Advisories

Red Hat

library-go: Secret data written to static pod logs when operator set at Debug level or higher↗2019-10-07

▶

💬Community

Bugzilla

CVE-2019-14854 library-go: Secret data written to static pod logs when operator set at Debug level or higher↗2019-10-07

▶