CVE-2019-19355: High severity red hat openshift vulnerability
An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. This CVE is specific to the openshift/ansible-operator-container as shipped in Openshift 4.
Other sources
It has been found that multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/ansible-operator-container.
Original bug: https://bugzilla.redhat.com/showbug.cgi?id=1791534
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-19355?
CVE-2019-19355 is classified with a high severity rating due to the potential for privilege escalation.
How do I fix CVE-2019-19355?
To fix CVE-2019-19355, update the OpenShift version to one that addresses this vulnerability.
What systems are affected by CVE-2019-19355?
CVE-2019-19355 affects Red Hat OpenShift version 4.0.
What is the impact of CVE-2019-19355?
The impact of CVE-2019-19355 includes the possibility for an attacker to alter the /etc/passwd file, resulting in privilege escalation.
Who can exploit CVE-2019-19355?
An attacker with access to the affected container can exploit CVE-2019-19355.