CVE-2019-10225: Medium severity red hat openshift vulnerability
A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and use it to authenticate to the GlusterFS REST service, gaining access to read, and modify files.
Other sources
The basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker able to edit a GlusterFS StorageClass is able to obtain the value of restuserkey.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-10225?
CVE-2019-10225 has been rated as a medium severity vulnerability due to potential unauthorized access to sensitive information.
How do I fix CVE-2019-10225?
To address CVE-2019-10225, update your OpenShift Container Platform to the latest version where the vulnerability is patched.
Who is affected by CVE-2019-10225?
CVE-2019-10225 affects users of OpenShift Container Platform versions 4.0, 4.2, and 3.11.
What is the impact of CVE-2019-10225?
The impact of CVE-2019-10225 allows attackers with basic-user permissions to leak the restuserkey, which may compromise security.
What component is primarily involved in CVE-2019-10225?
CVE-2019-10225 primarily involves the GlusterFS StorageClass in the OpenShift Container Platform.