REDHAT-BUG-1730161
First published: Tue Jul 16 2019(Updated: )
In the default configuration, OpenShift Container Platform 4 allows users with access to create pods the ability to schedule workloads on master nodes. Pods with permission to access the host network, running on master nodes, can retrieve security credentials for the master AWS IAM role, allowing management access to AWS resources. Pod access to the host network can be granted with the hostnetwork SCC. Original Bug: <a class="bz_bug_link bz_secure " title="" href="show_bug.cgi?id=1729242">https://bugzilla.redhat.com/show_bug.cgi?id=1729242</a> Upstream Fix: <a href="https://github.com/openshift/cluster-kube-apiserver-operator/pull/524">https://github.com/openshift/cluster-kube-apiserver-operator/pull/524</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat OpenShift Container Platform for IBM LinuxONE |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1729242
- https://github.com/openshift/cluster-kube-apiserver-operator/pull/524
- https://docs.openshift.com/container-platform/4.1/authentication/managing-security-context-constraints.html
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1730161#c5
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance
- https://docs.openshift.com/container-platform/4.4/authentication/managing-security-context-constraints.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1730161
Frequently Asked Questions
What is the severity of REDHAT-BUG-1730161?
The severity of REDHAT-BUG-1730161 is considered critical due to the potential of unauthorized access to sensitive AWS IAM roles.
How do I fix REDHAT-BUG-1730161?
To fix REDHAT-BUG-1730161, adjust the security context constraints to restrict pod scheduling on master nodes.
Who is affected by REDHAT-BUG-1730161?
REDHAT-BUG-1730161 affects users of the OpenShift Container Platform 4 with permissions to create pods.
What are the implications of REDHAT-BUG-1730161?
The implications of REDHAT-BUG-1730161 include potential exposure of sensitive security credentials and elevated privileges for unauthorized users.
What can I do to mitigate REDHAT-BUG-1730161 before a fix is available?
To mitigate REDHAT-BUG-1730161, limit access for users who can create pods and monitor pod activity closely.
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-10200
- agent/severity
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat openshift container platform for ibm linuxone