Bug 1777209 (CVE-2019-19335)

Summary: CVE-2019-19335 openshift/installer: kubeconfig and kubeadmin-password are created with word-readable permissions
Product: [Other] Security Response Reporter: Sam Fowler <sfowler>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: adahiya, aos-bugs, bmontgom, eparis, jburrell, jokerman, nstielau, sdodson, sfowler, sponnaga
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-02-12 14:09:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1778967, 1778968, 1778969, 1778970, 1778971, 1778972, 1778973, 1778974, 1781946    
Bug Blocks: 1768743    

Description Sam Fowler 2019-11-27 07:14:53 UTC 
During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and `kubeadmin-password` files. Both files contain credentials used to authenticate to the OpenShift API server, and are incorrectly assigned word-readable permissions.

In contrast, the `oc` command line tool creates configuration files that are only readable by the current user.
Comment 1 Sam Fowler 2019-11-27 07:18:55 UTC 
Config created with `openshift-install`:

$ ls -l auth/
-rw-r--r--. 1 root root  23 Nov 27 16:24 kubeadmin-password
-rw-r--r--. 1 root root 8949 Nov 27 16:24 kubeconfig

Config created with `oc adm create-kubeconfig`:

$ ls -l .kubeconfig 
-rw-------. 1 root root 10538 Nov 27 15:40 .kubeconfig
Comment 5 msiddiqu 2019-12-09 14:29:54 UTC 
Acknowledgments:

Name: Thom Carlin and Badre Tejado-Imam
Comment 6 errata-xmlrpc 2020-02-12 11:28:13 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.2

Via RHSA-2020:0463 https://access.redhat.com/errata/RHSA-2020:0463
Comment 7 errata-xmlrpc 2020-02-12 11:29:17 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.2

Via RHSA-2020:0476 https://access.redhat.com/errata/RHSA-2020:0476
Comment 8 Product Security DevOps Team 2020-02-12 14:09:35 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-19335