CoreCVE
Back

HIGH

openshift/postgresql-apb: /etc/passwd is given incorrect privileges

Published Mar 20, 2020

Description

A vulnerability was found in all openshift/postgresql-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the container openshift/postgresql-apb. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

Affected products

Remediation

Red Hat statement

By default this vulnerability is not exploitable in un-privilieged containers running on OpenShift Container Platform. This is because the system call SETUID and SETGID is blocked by the default seccomp policy.

Weaknesses (1)

CWE-732

Incorrect Permission Assignment

References (5)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published Mar 20, 2020
Updated Aug 4, 2024
Reserved Nov 27, 2019
Link CVE-2020-1707
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2020-1707
Red Hat
Severity Moderate
Public date Jan 21, 2020
Links CVE-2020-1707 - Bugzilla
ENISA EUVD
Assigner n/a
Published n/a
Updated n/a
Exploited since n/a
Link n/a