What is the severity of CVE-2020-35514?

CVE-2020-35514 has been rated as a high severity vulnerability due to the potential for unauthorized access and exploitation.

How do I fix CVE-2020-35514?

To mitigate CVE-2020-35514, ensure that proper permissions and access controls are in place for the /etc/kubernetes/kubeconfig file.

Which versions of OpenShift are affected by CVE-2020-35514?

CVE-2020-35514 affects Red Hat OpenShift versions prior to 4.7.0.

What type of flaw is described in CVE-2020-35514?

CVE-2020-35514 describes an insecure modification flaw that can be exploited by attackers with node or container access.

What impact does CVE-2020-35514 have on Kubernetes security?

CVE-2020-35514 can allow an attacker to manipulate the kubeconfig file and potentially add unauthorized nodes to the OpenShift cluster.

Vulnerability/
CVE-2020-35514

high

CWE

266

11/1/2021

2/6/2021

4/8/2024

CVE-2020-35514

First published: Mon Jan 11 2021(Updated: )

An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShift cluster. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects versions before openshift4/ose-machine-config-operator v4.7.0-202105111858.p0.

Credit: secalert@redhat.com

Affected Software	Affected Version	How to fix
Red Hat OpenShift	<4.7.0
Red Hat OpenShift	=4.7.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2020-35514?
CVE-2020-35514 has been rated as a high severity vulnerability due to the potential for unauthorized access and exploitation.
How do I fix CVE-2020-35514?
To mitigate CVE-2020-35514, ensure that proper permissions and access controls are in place for the /etc/kubernetes/kubeconfig file.
Which versions of OpenShift are affected by CVE-2020-35514?
CVE-2020-35514 affects Red Hat OpenShift versions prior to 4.7.0.
What type of flaw is described in CVE-2020-35514?
CVE-2020-35514 describes an insecure modification flaw that can be exploited by attackers with node or container access.
What impact does CVE-2020-35514 have on Kubernetes security?
CVE-2020-35514 can allow an attacker to manipulate the kubeconfig file and potentially add unauthorized nodes to the OpenShift cluster.

agent/references
agent/type
agent/first-publish-date
agent/weakness
agent/severity
agent/author
agent/description
collector/mitre-cve
source/MITRE
collector/redhat-bugzilla
source/Red Hat
alias/CVE-2020-35514
agent/last-modified-date
agent/event
agent/trending
agent/source
agent/tags
agent/softwarecombine
collector/nvd-index
agent/software-canonical-lookup-request
vendor/redhat
canonical/red hat openshift
version/red hat openshift/4.7.0

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.