During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and `kubeadmin-password` files. Both files contain credentials used to authenticate to the OpenShift API server, and are incorrectly assigned word-readable permissions. In contrast, the `oc` command line tool creates configuration files that are only readable by the current user.
Config created with `openshift-install`: $ ls -l auth/ -rw-r--r--. 1 root root 23 Nov 27 16:24 kubeadmin-password -rw-r--r--. 1 root root 8949 Nov 27 16:24 kubeconfig Config created with `oc adm create-kubeconfig`: $ ls -l .kubeconfig -rw-------. 1 root root 10538 Nov 27 15:40 .kubeconfig
Acknowledgments: Name: Thom Carlin and Badre Tejado-Imam
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.2 Via RHSA-2020:0463 https://access.redhat.com/errata/RHSA-2020:0463
This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.2 Via RHSA-2020:0476 https://access.redhat.com/errata/RHSA-2020:0476
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-19335