CVE-2019-10150: Medium severity red hat openshift container platform vulnerability
It was found that OpenShift Container Platform does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.
Other sources
It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.
OpenShift builds don't seem to cache the SSH key of the git repository. This allows an attacker who can MiTM, take over DNS etc to supply their own content.
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2019-10150?
CVE-2019-10150 is considered a critical vulnerability as it allows attackers to manipulate build outputs due to lack of SSH Host Key checking.
How do I fix CVE-2019-10150?
To fix CVE-2019-10150, update your OpenShift Container Platform to one of the remediated versions specified in the advisory, such as 3.10.175-1.git.0.f9f0e81.el7 or later.
Which versions of OpenShift Container Platform are affected by CVE-2019-10150?
Versions of OpenShift Container Platform from 3.6 to less than 4.1 are affected by CVE-2019-10150.
What can an attacker do with CVE-2019-10150?
An attacker can redirect network traffic to alter the build output of OpenShift Container Platform due to the disabled SSH Host Key checking.
Is CVE-2019-10150 specific to Red Hat OpenShift?
Yes, CVE-2019-10150 specifically affects the Red Hat OpenShift Container Platform and its associated components.