Bug 1677117 (CVE-2019-3841) - CVE-2019-3841 kubevirt/virt-cdi-importer: improper TLS certificate validation
Summary: CVE-2019-3841 kubevirt/virt-cdi-importer: improper TLS certificate validation
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2019-3841
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=moderate,public=20190226:2130,...
Depends On: 1677155
Blocks: 1677153
TreeView+ depends on / blocked
 
Reported: 2019-02-14 05:23 UTC by Paul Harvey
Modified: 2019-06-11 11:13 UTC (History)
4 users (show)

Fixed In Version: virt-cdi-importer 1.4
Doc Type: If docs needed, set a value
Doc Text:
Kubevirt/virt-cdi-importer, versions 1.4.0 to 1.5.3 inclusive, were reported to disable TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible undetected tampering of trusted container image content.
Clone Of:
Environment:
Last Closed: 2019-06-10 10:47:58 UTC


Attachments (Terms of Use)

Description Paul Harvey 2019-02-14 05:23:36 UTC
kubevirt/virt-cdi-importer [1] v1.4.0 to v1.5.3 inclusive were reported to be disabling TLS certificate validation when importing data into PVCs from container registries. This could enable man-in-the-middle attacks between a container registry and the virt-cdi-component, leading to possible undetected tampering of trusted container image content.

[1] https://github.com/kubevirt/containerized-data-importer

Comment 1 Paul Harvey 2019-02-14 05:23:38 UTC
Statement:

No public release of Red Hat Container Native Virtualization is affected by this flaw.

Comment 2 Paul Harvey 2019-02-14 05:23:40 UTC
UNCONFIRMED: To configure /etc/containers/policy.json to validate GPG signed container images where possible, see [1]. For information about integrating container image signing into container publishing workflow, see [2].

[1] https://github.com/containers/image/blob/f0cbc16b444d729362c78244c715b45bf4019b71/docs/containers-policy.json.md
[2] https://access.redhat.com/articles/2750891

Comment 9 Paul Harvey 2019-02-28 02:38:11 UTC
External References:

https://github.com/kubevirt/containerized-data-importer/issues/678

Comment 10 Paul Harvey 2019-02-28 02:38:15 UTC
Mitigation:

The vulnerability can only be triggered by an authenticated kubernetes user who is authorized to create PVCs. To mitigate, do not create PVCs with the "cdi.kubevirt.io/storage.import.source: "registry"" annotation and do not create DataVolumes that use the "registry" source.


Note You need to log in before you can comment on or make changes to this bug.