library-go: Secret data written to static pod logs when operator set at Debug level or higher
Published Jan 7, 2020
6.5
MEDIUMCVSS 3.1
EPSS 0.80%
Description
OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.
Affected products
-
- Version As shipped with Openshift 4.xStatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Red Hat | Library-GO | n/a |
|
- 4.1
- 4.2
No data.
Red Hat OpenShift Container Platform 4.1
openshift4/ose-cluster-kube-apiserver-operator:v4.1.26-201911260202
Fixed · RHSA-2019:4081
Red Hat OpenShift Container Platform 4.1
openshift4/ose-cluster-kube-controller-manager-operator:v4.1.27-201912030019
Fixed · RHSA-2019:4091
Red Hat OpenShift Container Platform 4.1
openshift4/ose-cluster-kube-scheduler-operator:v4.1.27-201912030019
Fixed · RHSA-2019:4091
Red Hat OpenShift Container Platform 4.2
openshift4/ose-cluster-kube-apiserver-operator:v4.2.9-201911261133
Fixed · RHSA-2019:4075
Red Hat OpenShift Container Platform 4.2
openshift4/ose-cluster-kube-controller-manager-operator:v4.2.10-201912022352
Fixed · RHSA-2019:4098
Red Hat OpenShift Container Platform 4.2
openshift4/ose-cluster-kube-scheduler-operator:v4.2.9-201911261133
Fixed · RHSA-2019:4075
Red Hat OpenShift Container Platform 4
library-go
Affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat OpenShift Container Platform 4.1 | openshift4/ose-cluster-kube-apiserver-operator:v4.1.26-201911260202 | Fixed | RHSA-2019:4081 |
| Red Hat OpenShift Container Platform 4.1 | openshift4/ose-cluster-kube-controller-manager-operator:v4.1.27-201912030019 | Fixed | RHSA-2019:4091 |
| Red Hat OpenShift Container Platform 4.1 | openshift4/ose-cluster-kube-scheduler-operator:v4.1.27-201912030019 | Fixed | RHSA-2019:4091 |
| Red Hat OpenShift Container Platform 4.2 | openshift4/ose-cluster-kube-apiserver-operator:v4.2.9-201911261133 | Fixed | RHSA-2019:4075 |
| Red Hat OpenShift Container Platform 4.2 | openshift4/ose-cluster-kube-controller-manager-operator:v4.2.10-201912022352 | Fixed | RHSA-2019:4098 |
| Red Hat OpenShift Container Platform 4.2 | openshift4/ose-cluster-kube-scheduler-operator:v4.2.9-201911261133 | Fixed | RHSA-2019:4075 |
| Red Hat OpenShift Container Platform 4 | library-go | Affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (6)
- https://access.redhat.com/security/cve/CVE-2019-14854 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1758953 Issue Tracking
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14854 x_refsource_CONFIRMExploitIssue TrackingThird Party Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-5976 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-14854
- https://www.cve.org/CVERecord?id=CVE-2019-14854
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-14854 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1758953 | Issue Tracking | |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14854 | x_refsource_CONFIRMExploitIssue TrackingThird Party Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-5976 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-14854 | ||
| https://www.cve.org/CVERecord?id=CVE-2019-14854 |
Change history (0)
No recorded changes yet.