Bug 1825161 (CVE-2020-10712)
| Summary: | CVE-2020-10712 openshift/cluster-image-registry-operator: secrets disclosed in logs | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Jason Shepherd <jshepherd> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | adam.kaplan, aos-bugs, bmontgom, bparees, eparis, fmarquez, jburrell, jokerman, nstielau, obulatov, security-response-team, sponnaga |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
A flaw was found in OpenShift Container Platform versions from 4.1 to 4.4 inclusive. Sensitive information was found to be logged by the image registry operator allowing an attacker able to gain access to those logs, to read and write to the storage backing the internal image registry. The highest threat from this vulnerability is to data integrity.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-05-12 10:33:28 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1825164, 1825165, 1825718, 1825719, 1825720 | ||
| Bug Blocks: | 1824779 | ||
|
Description
Jason Shepherd
2020-04-17 09:16:26 UTC
Acknowledgments: Name: Adam Kaplan (Red Hat) Mitigation: Ensure that the image registry operator logs remain private. This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.3 Via RHSA-2020:2009 https://access.redhat.com/errata/RHSA-2020:2009 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-10712 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.2 Via RHSA-2020:2026 https://access.redhat.com/errata/RHSA-2020:2026 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.4 Via RHSA-2020:2136 https://access.redhat.com/errata/RHSA-2020:2136 Statement: References to internal container components making up OpenShift Container Platform 4.x itself all use digests to refer to container images [1]. Therefore any changes to the images in the registry storage will invalidate those references. This issue could allow an attacker to modify other container image content that is referred to by tag however. [1] https://www.redhat.com/en/blog/securing-deployment-openshift-container-platform-4 |