CVE-2019-19335: Medium severity red hat openshift vulnerability
During installation of an OpenShift 4 cluster, the openshift-install command line tool creates an auth directory, with kubeconfig and kubeadmin-password files. Both files contain credentials used to authenticate to the OpenShift API server, and are incorrectly assigned word-readable permissions.
In contrast, the oc command line tool creates configuration files that are only readable by the current user.
Other sources
During installation of an OpenShift 4 cluster, the openshift-install command line tool creates an auth directory, with kubeconfig and kubeadmin-password files. Both files contain credentials used to authenticate to the OpenShift API server, and are incorrectly assigned word-readable permissions. ose-installer as shipped in Openshift 4.2 is vulnerable.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19335?
CVE-2019-19335 is classified as a high severity vulnerability due to the exposure of sensitive authentication credentials.
How do I fix CVE-2019-19335?
To fix CVE-2019-19335, ensure that the permissions on the 'auth' directory and the files within it are restricted to prevent unauthorized access.
Which versions of software are affected by CVE-2019-19335?
CVE-2019-19335 affects Red Hat OpenShift versions 4.0 and 4.2.
What components are involved in CVE-2019-19335?
CVE-2019-19335 involves the 'openshift-install' command line tool which improperly sets file permissions for sensitive kubeconfig and kubeadmin-password files.
What types of systems are impacted by CVE-2019-19335?
CVE-2019-19335 impacts systems utilizing OpenShift installations where authentication credentials are stored with inadequate permissions.