CVE-2020-35514: High severity red hat openshift vulnerability
An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShift cluster. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects versions before openshift4/ose-machine-config-operator v4.7.0-202105111858.p0.
Other sources
It has been found that the permissions of the /etc/kubernetes/kubeconfig on an OpenShift node are too permissive. An attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, may copy this kubeconfig file and potentially attempt to add their own rogue node to the OpenShift cluster.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-35514?
CVE-2020-35514 has been rated as a high severity vulnerability due to the potential for unauthorized access and exploitation.
How do I fix CVE-2020-35514?
To mitigate CVE-2020-35514, ensure that proper permissions and access controls are in place for the /etc/kubernetes/kubeconfig file.
Which versions of OpenShift are affected by CVE-2020-35514?
CVE-2020-35514 affects Red Hat OpenShift versions prior to 4.7.0.
What type of flaw is described in CVE-2020-35514?
CVE-2020-35514 describes an insecure modification flaw that can be exploited by attackers with node or container access.
What impact does CVE-2020-35514 have on Kubernetes security?
CVE-2020-35514 can allow an attacker to manipulate the kubeconfig file and potentially add unauthorized nodes to the OpenShift cluster.