REDHAT-BUG-1754662
First published: Mon Sep 23 2019(Updated: )
A vulnerability was found in OpenShift builds. Builds which extract source from a container image bypass TLS hostname verification. An attacker can take advantage of this by launching a man-in-the-middle attack and injecting malicious content. References: <a href="https://github.com/openshift/builder/blob/04c78176099139a5d229578a9a98ed2e1d17a19d/pkg/build/builder/source.go#L383-L385">https://github.com/openshift/builder/blob/04c78176099139a5d229578a9a98ed2e1d17a19d/pkg/build/builder/source.go#L383-L385</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat OpenShift Origin |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/openshift/builder/blob/04c78176099139a5d229578a9a98ed2e1d17a19d/pkg/build/builder/source.go#L383-L385
- https://access.redhat.com/errata/RHSA-2019:4101
- https://access.redhat.com/security/cve/cve-2019-14845
- https://access.redhat.com/errata/RHSA-2019:4237
- https://bugzilla.redhat.com/show_bug.cgi?id=1754662
Frequently Asked Questions
What is the severity of REDHAT-BUG-1754662?
The severity of REDHAT-BUG-1754662 is considered critical due to its potential for man-in-the-middle attacks.
How do I fix REDHAT-BUG-1754662?
To fix REDHAT-BUG-1754662, update your OpenShift installation to the latest patched version provided by Red Hat.
What types of attacks leverage the REDHAT-BUG-1754662 vulnerability?
Attackers can leverage the REDHAT-BUG-1754662 vulnerability to perform man-in-the-middle attacks and inject malicious content.
Which software is affected by REDHAT-BUG-1754662?
REDHAT-BUG-1754662 affects Red Hat OpenShift builds that extract source from container images.
What is the primary issue with REDHAT-BUG-1754662?
The primary issue with REDHAT-BUG-1754662 is that it allows source extraction from container images to bypass TLS hostname verification.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-14845
- agent/event
- agent/severity
- agent/references
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat openshift origin