CVE-2020-1704: High severity redhat Openshift Service Mesh vulnerability
An insecure modification vulnerability in the /etc/passwd file was found in all versions of OpenShift ServiceMesh (maistra) before 1.0.8 in the openshift/istio-kialia-rhel7-operator-container. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openshift/istio-kialia-rhel7-operator-containerto a version that resolves this vulnerability.Fixed in 1.0.8
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-1704.
What is the severity level of CVE-2020-1704?
The severity level of CVE-2020-1704 is high.
What is the affected software of CVE-2020-1704?
The affected software of CVE-2020-1704 is Redhat Openshift Service Mesh before version 1.0.8.
What is the Common Weakness Enumeration (CWE) number for CVE-2020-1704?
The Common Weakness Enumeration (CWE) number for CVE-2020-1704 is 732 and 266.
How can I fix the insecure modification vulnerability in OpenShift ServiceMesh?
To fix the insecure modification vulnerability, update OpenShift ServiceMesh to version 1.0.8 or later.