CVE-2020-1742: High severity kubernetes-nmstate vulnerability
Withdrawn Advisory This advisory has been withdrawn. This link is maintained to preserve external references.
Original Description An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Versions before kubernetes-nmstate-handler-container-v2.3.0-30 are affected.
Other sources
It has been found that multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the nmstate/kubernetes-nmstate-handler container.
Original bug: https://bugzilla.redhat.com/showbug.cgi?id=1791534
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-1742?
CVE-2020-1742 has been withdrawn and does not currently have a defined severity.
How do I fix CVE-2020-1742?
Since CVE-2020-1742 has been withdrawn, there are no specific fixes or recommendations available.
What software is affected by CVE-2020-1742?
CVE-2020-1742 affects nmstate/kubernetes-nmstate-handler containers up to version 2.3.0-30.
Can I still use the software affected by CVE-2020-1742?
While CVE-2020-1742 is withdrawn, it is advisable to check for any alternative vulnerabilities and stay updated with software best practices.
What does it mean that CVE-2020-1742 is a withdrawn advisory?
A withdrawn advisory indicates that the original reports or details no longer apply, and there is no actionable information for the claimed vulnerability.