Bug 1758953 (CVE-2019-14854) - CVE-2019-14854 library-go: Secret data written to static pod logs when operator set at Debug level or higher
Summary: CVE-2019-14854 library-go: Secret data written to static pod logs when operat...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-14854
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1758954 1758955 1758956 1758957 1758958 1758959 1758961 1758962 1758963 1761279 1761280 1761281
Blocks: 1758950
TreeView+ depends on / blocked
 
Reported: 2019-10-07 03:15 UTC by Jason Shepherd
Modified: 2020-03-18 04:53 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.
Clone Of:
Environment:
Last Closed: 2019-12-04 01:04:51 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github openshift library-go pull 549 0 'None' closed Bug 1761280: don't log secret data 2020-03-23 21:49:26 UTC
Red Hat Product Errata RHSA-2019:4075 0 None None None 2019-12-03 21:11:54 UTC
Red Hat Product Errata RHSA-2019:4081 0 None None None 2019-12-04 13:54:51 UTC
Red Hat Product Errata RHSA-2019:4091 0 None None None 2019-12-17 07:38:49 UTC
Red Hat Product Errata RHSA-2019:4098 0 None None None 2019-12-11 08:23:40 UTC

Description Jason Shepherd 2019-10-07 03:15:25 UTC 
OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

This is similar to CVE-2019-10213 but different in that it only affects operators that create and manage static pods.
Comment 10 errata-xmlrpc 2019-12-03 21:11:53 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.2

Via RHSA-2019:4075 https://access.redhat.com/errata/RHSA-2019:4075
Comment 11 Product Security DevOps Team 2019-12-04 01:04:51 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-14854
Comment 12 errata-xmlrpc 2019-12-04 13:54:49 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:4081 https://access.redhat.com/errata/RHSA-2019:4081
Comment 13 errata-xmlrpc 2019-12-11 08:23:36 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.2

Via RHSA-2019:4098 https://access.redhat.com/errata/RHSA-2019:4098
Comment 14 errata-xmlrpc 2019-12-17 07:38:47 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:4091 https://access.redhat.com/errata/RHSA-2019:4091
Note You need to log in before you can comment on or make changes to this bug.