Vulnerability Details CVE-2019-10214
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 54.8%
CVSS Severity
CVSS v3 Score 6.4
CVSS v2 Score 4.3
References
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214
- http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00035.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214
Products affected by CVE-2019-10214
-
cpe:2.3:a:buildah_project:buildah:-
-
cpe:2.3:a:libpod_project:libpod:-
-
cpe:2.3:a:redhat:openshift_container_platform:4.1
-
cpe:2.3:a:skopeo_project:skopeo:-
-
cpe:2.3:o:opensuse:leap:15.1
-
cpe:2.3:o:redhat:enterprise_linux:8.0