operator-framework/presto: /etc/passwd is given incorrect privileges
Published Mar 24, 2021
7.0
HIGHCVSS 3.1
EPSS 0.26%
Description
An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.
Affected products
- Vendor n/a Product Operator-Framework/presto Defaultn/a
- Version as shipped in Red Hat Openshift 4StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | Operator-Framework/presto | n/a |
|
- 4.0
No data.
Red Hat OpenShift Container Platform 4.4
openshift4/ose-metering-presto:v4.4.0-202004261927
Fixed · RHSA-2020:1942
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat OpenShift Container Platform 4.4 | openshift4/ose-metering-presto:v4.4.0-202004261927 | Fixed | RHSA-2020:1942 |
No package ranges for this CVE.
Remediation
Red Hat statement
By default this vulnerability is not exploitable in un-privilieged containers running on OpenShift Container Platform. This is because the system call SETUID and SETGID is blocked by the default seccomp policy.
References (5)
- https://access.redhat.com/security/cve/CVE-2019-19352 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1791534 x_refsource_MISCIssue TrackingVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1793281 x_refsource_MISCIssue TrackingVendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-19352
- https://www.cve.org/CVERecord?id=CVE-2019-19352
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2019-19352 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1791534 | x_refsource_MISCIssue TrackingVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1793281 | x_refsource_MISCIssue TrackingVendor Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-19352 | ||
| https://www.cve.org/CVERecord?id=CVE-2019-19352 |
Change history (0)
No recorded changes yet.