CVE-2019-10213: Medium severity red hat openshift container platform vulnerability
OpenShift Container Platform 4 does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.
Upstream Fix:
https://github.com/openshift/library-go/pull/472
Other sources
OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10213?
CVE-2019-10213 has been rated with moderate severity due to the exposure of sensitive secret data in pod logs.
How do I fix CVE-2019-10213?
To mitigate CVE-2019-10213, it is recommended to avoid setting the log level to Debug or higher in affected OpenShift Container Platform versions.
Which versions of OpenShift Container Platform are affected by CVE-2019-10213?
CVE-2019-10213 affects OpenShift Container Platform versions 4.1 and 4.2 specifically.
Can a low privileged user exploit CVE-2019-10213?
Yes, a low privileged user can access sensitive secret data by reading pod logs if the log level is set to Debug or higher.
Is there a workaround for CVE-2019-10213?
As a workaround for CVE-2019-10213, users should ensure that log levels remain below Debug to prevent sensitive information exposure.