CVE-2019-19353 - operator-framework/hive: /etc/passwd is given incorrect privileges

Back Back to CVE browser

HIGH

operator-framework/hive: /etc/passwd is given incorrect privileges

Published Mar 24, 2021

7.0

HIGH

CVSS 3.1

EPSS 0.33%

Description

An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hive as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

Affected products

Vendor n/a Product Operator-Framework/hive Default
n/a
- Version
  as shipped in Red Hat Openshift 4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Operator-Framework/hive

n/a

Version	Status	Constraints
as shipped in Red Hat Openshift 4	affected	-

Product	Package	State	Advisory
Red Hat OpenShift Container Platform 4	openshift4/ose-metering-hive	Will not fix	n/a

Remediation

Red Hat statement

By default this vulnerability is not exploitable in un-privilieged containers running on OpenShift Container Platform. This is because the system call SETUID and SETGID is blocked by the default seccomp policy.

Weaknesses (1)

CWE-266

Incorrect Privilege Assignment

References (6)

https://access.redhat.com/articles/4859371
x_refsource_MISCVendor Advisory
https://access.redhat.com/security/cve/CVE-2019-19353
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1791534
x_refsource_MISCExploitIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1793279
x_refsource_MISCIssue TrackingVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-19353
https://www.cve.org/CVERecord?id=CVE-2019-19353

Link	Providers	Tags
https://access.redhat.com/articles/4859371		x_refsource_MISCVendor Advisory
https://access.redhat.com/security/cve/CVE-2019-19353		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1791534		x_refsource_MISCExploitIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1793279		x_refsource_MISCIssue TrackingVendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-19353
https://www.cve.org/CVERecord?id=CVE-2019-19353