CVE-2019-10200: Critical severity red hat openshift container platform vulnerability
A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS IAM role, allowing management access to AWS resources. With access to the security credentials, the user then has access to the entire infrastructure. Impact to data and system availability is high.
Other sources
In the default configuration, OpenShift Container Platform 4 allows users with access to create pods the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS IAM role, allowing management access to AWS resources. Pod access to the host network can be granted with the hostnetwork SCC.
Original Bug:
https://bugzilla.redhat.com/showbug.cgi?id=1729242
Upstream Fix:
https://github.com/openshift/cluster-kube-apiserver-operator/pull/524
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10200?
CVE-2019-10200 has been classified as a high severity vulnerability due to its potential impact on cluster security.
How do I fix CVE-2019-10200?
To fix CVE-2019-10200, you should restrict pod security contexts and ensure that users do not have permissions to schedule workloads on master nodes.
What are the potential risks of CVE-2019-10200?
The potential risks of CVE-2019-10200 include unauthorized access to AWS IAM security credentials and increased attack surface on master nodes.
Which version of OpenShift Container Platform is affected by CVE-2019-10200?
CVE-2019-10200 affects version 4.0 of the OpenShift Container Platform.
Can CVE-2019-10200 lead to data breaches?
Yes, CVE-2019-10200 can potentially lead to data breaches if malicious users exploit the vulnerability to gain access to sensitive information.