Bug 1713433 (CVE-2019-10150) - CVE-2019-10150 atomic-openshift: OpenShift builds don't verify SSH Host Keys for the git repository
Summary: CVE-2019-10150 atomic-openshift: OpenShift builds don't verify SSH Host Keys ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-10150
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1715256 1713446 1713671 1713673 1713674 1713675 1713676 1745789 1755138
Blocks: 1711901
TreeView+ depends on / blocked
 
Reported: 2019-05-23 16:13 UTC by Pedro Sampaio
Modified: 2019-11-29 05:27 UTC (History)
18 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that OpenShift Container Platform does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.
Clone Of:
Environment:
Last Closed: 2019-10-14 12:51:19 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:3820 None None None 2019-11-11 09:57:39 UTC
Red Hat Product Errata RHSA-2019:2989 None None None 2019-10-14 08:48:57 UTC
Red Hat Product Errata RHSA-2019:3007 None None None 2019-10-16 17:39:53 UTC
Red Hat Product Errata RHSA-2019:3143 None None None 2019-10-18 01:34:11 UTC
Red Hat Product Errata RHSA-2019:3811 None None None 2019-11-07 16:54:20 UTC

Description Pedro Sampaio 2019-05-23 16:13:36 UTC
OpenShift builds don't seem to cache the SSH key of the git repository. This allows an attacker who can MiTM, take over DNS etc to supply their own content.

Comment 1 Dave Baker 2019-05-23 16:21:04 UTC
Created repro; confirmed against 3.9, 3.11 and 4.1 rc5.

Comment 2 Dave Baker 2019-05-23 16:31:22 UTC
Tracked to scmauth/sshkey.go within builder.  Link here is for 3.11

https://github.com/openshift/origin/blob/release-3.11/pkg/build/builder/cmd/scmauth/sshkey.go#L26-L28

	content := "#!/bin/sh\nssh -i " +
		filepath.Join(baseDir, SSHPrivateKeyMethodName) +
		" -o StrictHostKeyChecking=false \"$@\"\n"

Comment 3 Dave Baker 2019-05-23 16:47:55 UTC
Flagging 3.6 and later as all affected from observation of source code.

Comment 8 Marian Rehak 2019-05-29 12:29:35 UTC
Acknowledgments:

Name: @l14n_uk

Comment 9 Dave Baker 2019-05-29 20:25:03 UTC
Statement:

OpenShift Container Platform allows for various types of "source clone secrets" to be defined in order to permit building from non-public git repositories.  When using ssh key authentication, the server host key checking function is disabled.

An attacker with the ability to redirect the network traffic and perform a "man in the middle" attack will be able to redirect the build job to use arbitrary content of their choosing.

Note that the same flaw (non-verification of remote server) is present when using HTTP, or when using HTTPS with TLS verification manually disabled.

Comment 11 Dave Baker 2019-05-29 20:25:06 UTC
Mitigation:

Use only methods (such as HTTPS with TLS verification) that enable the identity of the remote repository to be validated.

Comment 12 Dave Baker 2019-05-30 00:07:19 UTC
Updating CVSS to align to other MITM style flaws.
- MITM can be performed through many means (DNS redirection, traffic redirection, etc), leading to a complex attack.
- Attacking user needs no local privs on the cluster, and with MITM abilities can observe traffic requests in order to construct their attack.
- Scope is unchanged - whatever permissions in the cluster the builder pod has, they remain the same with the altered build content.

Comment 14 Dave Baker 2019-05-30 00:12:52 UTC
Created origin tracking bugs for this issue:

Affects: fedora-all [bug 1715256]

Comment 24 errata-xmlrpc 2019-10-14 08:48:55 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.10

Via RHSA-2019:2989 https://access.redhat.com/errata/RHSA-2019:2989

Comment 25 Product Security DevOps Team 2019-10-14 12:51:19 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10150

Comment 26 errata-xmlrpc 2019-10-16 17:39:52 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.1

Via RHSA-2019:3007 https://access.redhat.com/errata/RHSA-2019:3007

Comment 27 errata-xmlrpc 2019-10-18 01:34:09 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.11

Via RHSA-2019:3143 https://access.redhat.com/errata/RHSA-2019:3143

Comment 28 errata-xmlrpc 2019-11-07 16:54:19 UTC
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 3.9

Via RHSA-2019:3811 https://access.redhat.com/errata/RHSA-2019:3811


Note You need to log in before you can comment on or make changes to this bug.