operator-framework/operator-metering: /etc/passwd is given incorrect privileges
Published Mar 24, 2021
7.8
HIGHCVSS 3.1
EPSS 0.34%
Description
An insecure modification vulnerability in the /etc/passwd file was found in the container operator-framework/operator-metering as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
Affected products
- Vendor n/a Product Operator-Framework/operator-Metering Defaultn/a
- Version as shipped in Red Hat Openshift 4StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Operator-Framework/operator-Metering | n/a |
|
No data.
Red Hat OpenShift Container Platform 4
openshift4/ose-metering-ansible-operator
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat OpenShift Container Platform 4 | openshift4/ose-metering-ansible-operator | Will not fix | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
By default this vulnerability is not exploitable in un-privilieged containers running on OpenShift Container Platform. This is because the system call SETUID and SETGID is blocked by the default seccomp policy.
References (6)
- https://access.redhat.com/security/cve/CVE-2019-19349 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1791534 x_refsource_MISCExploitIssue TrackingProductVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1793284 x_refsource_MISCIssue TrackingVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8970 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-19349
- https://www.cve.org/CVERecord?id=CVE-2019-19349
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-19349 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1791534 | x_refsource_MISCExploitIssue TrackingProductVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1793284 | x_refsource_MISCIssue TrackingVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8970 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-19349 | ||
| https://www.cve.org/CVERecord?id=CVE-2019-19349 |
Change history (0)
No recorded changes yet.