Bug 1743073 (CVE-2019-10225)

Summary:	CVE-2019-10225 atomic-openshift: The basic-user RBAC role allow leaking of GlusterFS StorageClass restuserkey value
Product:	[Other] Security Response	Reporter:	Jason Shepherd <jshepherd>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	45r06t38, ahardin, bleanhar, bmontgom, ccoleman, dedgar, eparis, jburrell, jgoulding, jokerman, mchappel, nstielau, sponnaga
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in atomic-openshift where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and use it to authenticate to the GlusterFS REST service, gaining access to read, and modify files.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-27 10:48:27 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1743089
Bug Blocks:	1738422, 1940808

Description Jason Shepherd 2019-08-19 05:19:05 UTC

The basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker able to edit a GlusterFS StorageClass is able to obtain the value of restuserkey.

Comment 1 Jason Shepherd 2019-08-19 05:19:08 UTC

Acknowledgments:

Name: Morten Skou (UFST), Rune Henriksen (UFST)

Comment 2 Jason Shepherd 2019-08-19 05:19:11 UTC

Mitigation:

Use of the restuserkey in GlusterFS StorageClass is deprecated upstream [1] and will be removed in a future release. To mitigate this vulnerability make use of secretName, and secretNamespace parameters to store the Gluster REST service password. 
[1] https://kubernetes.io/docs/concepts/storage/storage-classes/#glusterfs