Bug 1754662 (CVE-2019-14845)

Summary:	CVE-2019-14845 openshift: Container image TLS verification bypass
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	adam.kaplan, ahardin, aos-bugs, bleanhar, bmontgom, ccoleman, dedgar, eparis, jburrell, jgoulding, jokerman, jshepherd, mchappel, nstielau, security-response-team, sponnaga, wzheng
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in OpenShift builds. Builds that extract source from a container image, bypass the TLS hostname verification. An attacker can take advantage of this flaw by launching a man-in-the-middle attack and injecting malicious content.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-12-11 13:24:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1754680, 1754681, 1755140, 1771053
Bug Blocks:	1754663

Description Pedro Sampaio 2019-09-23 20:32:41 UTC

A vulnerability was found in OpenShift builds. Builds which extract source from a container image bypass TLS hostname verification. An attacker can take advantage of this by launching a man-in-the-middle attack and injecting malicious content.

References:

https://github.com/openshift/builder/blob/04c78176099139a5d229578a9a98ed2e1d17a19d/pkg/build/builder/source.go#L383-L385

Comment 2 Jason Shepherd 2019-09-23 21:53:33 UTC

Acknowledgments:

Name: Miloslav Trmač (Red Hat)

Comment 7 errata-xmlrpc 2019-12-11 08:32:33 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.2

Via RHSA-2019:4101 https://access.redhat.com/errata/RHSA-2019:4101

Comment 8 Product Security DevOps Team 2019-12-11 13:24:02 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14845

Comment 9 errata-xmlrpc 2019-12-19 22:58:49 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:4237 https://access.redhat.com/errata/RHSA-2019:4237