CVE-2019-14854: Medium severity red hat openshift container platform vulnerability

Published Jan 7, 2020

Updated

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

Affected Software

2 affected components

redhat OpenShift Container Platform=4.1

redhat OpenShift Container Platform=4.2

Event History

Jan 7, 2020

CVE Published

via MITRE·04:36 PM

Data Sourced

via MITRE·04:36 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2019-14854?

CVE-2019-14854 is considered to have a medium severity due to the potential exposure of sensitive information.

How do I fix CVE-2019-14854?

To mitigate CVE-2019-14854, ensure that the log level in OpenShift Container Platform 4 is not set to Debug or higher.

Which versions of OpenShift Container Platform are affected by CVE-2019-14854?

CVE-2019-14854 affects Red Hat OpenShift Container Platform versions 4.1 and 4.2.

What is the impact of CVE-2019-14854 exploitation?

Exploitation of CVE-2019-14854 allows a low-privileged user to access secret data from static pod logs.

Who can be affected by CVE-2019-14854?

Low-privileged users may be affected if an operator has modified the log level to Debug or higher.