CVE-2019-19355

openshift/ocp-release-operator-sdk: /etc/passwd is given incorrect privileges

An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. This CVE is specific to the openshift/ansible-operator-container as shipped in Openshift 4.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2019-19354

operator-framework/hadoop: /etc/passwd is given incorrect privileges

An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Openshift Container Platform

CVE-2019-19353

operator-framework/hive: /etc/passwd is given incorrect privileges

An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hive as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Container Platform

CVE-2019-19352

operator-framework/presto: /etc/passwd is given incorrect privileges

An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2019-19351

openshift/jenkins: /etc/passwd is given incorrect privileges

An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. This CVE is specific to the openshift/jenkins-slave-base-rhel7-containera as shipped in Openshift 4 and 3.11.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2019-19350

openshift/ansible-service-broker: /etc/passwd is given incorrect privileges

An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ansible-service-broker as shipped in Red Hat Openshift 4 and 3.11. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2019-19349

operator-framework/operator-metering: /etc/passwd is given incorrect privileges

An insecure modification vulnerability in the /etc/passwd file was found in the container operator-framework/operator-metering as shipped in Red Hat Openshift 4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2019-19348

openshift/apb-base: /etc/passwd is given incorrect privileges

An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/apb-base, affecting versions before the following 4.3.5, 4.2.21, 4.1.37, and 3.11.188-4. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2019-19346

openshift/mariadb-apb: /etc/passwd is given incorrect privileges

An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before the following 4.3.5, 4.2.21, 4.1.37, and 3.11.188-4 . An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2019-19345

openshift/mediawiki-apb: /etc/passwd is given incorrect privileges

A vulnerability was found in all openshift/mediawiki-apb 4.x.x versions prior to 4.3.0, where an insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mediawiki-apb. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2019-19343

Undertow: Memory Leak in Undertow HttpOpenListener due to holding remoting connections indefinitely

A flaw was found in Undertow when using Remoting as shipped in Red Hat Jboss EAP before version 7.2.4. A memory leak in HttpOpenListener due to holding remote connections indefinitely may lead to denial of service. Versions before undertow 2.0.25.SP1 and jboss-remoting 5.0.14.SP1 are believed to be vulnerable.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Netapp Redhat

Products

Active Iq Unified Manager Jboss-remoting Jboss Enterprise Application Platform and 3 more

CVE-2019-19342

Tower: special characters in RabbitMQ passwords causes web socket 500 error

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4, when /websocket is requested and the password contains the '#' character. This request would cause a socket error in RabbitMQ when parsing the password and an HTTP error code 500 and partial password disclose will occur in plaintext. An attacker could easily guess some predictable passwords or brute force the password.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2019-19341

Tower: intermediate files during Tower backup are world-readable

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2, where files in '/var/backup/tower' are left world-readable. These files include both the SECRET_KEY and the database backup. Any user with access to the Tower server, and knowledge of when a backup is run, could retrieve every credential stored in Tower. Access to data is the highest threat with this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2019-19340

Tower: enabling RabbitMQ manager in the installer exposes the management interface publicly

A flaw was found in Ansible Tower, versions 3.6.x before 3.6.2 and 3.5.x before 3.5.3, where enabling RabbitMQ manager by setting it with '-e rabbitmq_enable_manager=true' exposes the RabbitMQ management interface publicly, as expected. If the default admin user is still active, an attacker could guess the password and gain access to the system.

CVSS 3.1 · 8.2 High EPSS 1.5% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower Enterprise Linux

CVE-2019-19339

kpatch: hw: incomplete fix for CVE-2018-12207

It was found that the Red Hat Enterprise Linux 8 kpatch update did not include the complete fix for CVE-2018-12207. A flaw was found in the way Intel CPUs handle inconsistency between, virtual to physical memory address translations in CPU's local cache and system software's Paging structure entries. A privileged guest user may use this flaw to induce a hardware Machine Check Error on the host processor, resulting in a severe DoS scenario by halting the processor. System software like OS OR Virtual Machine Monitor (VMM) use virtual memory system for storing program instructions and data in memory. Virtual Memory system uses Paging structures like Page Tables and Page Directories to manage system memory. The processor's Memory Management Unit (MMU) uses Paging structure entries to translate program's virtual memory addresses to physical memory addresses. The processor stores these address translations into its local cache buffer called - Translation Lookaside Buffer (TLB). TLB has two parts, one for instructions and other for data addresses. System software can modify its Paging structure entries to change address mappings OR certain attributes like page size etc. Upon such Paging structure alterations in memory, system software must invalidate the corresponding address translations in the processor's TLB cache. But before this TLB invalidation takes place, a privileged guest user may trigger an instruction fetch operation, which could use an already cached, but now invalid, virtual to physical address translation from Instruction TLB (ITLB). Thus accessing an invalid physical memory address and resulting in halting the processor due to the Machine Check Error (MCE) on Page Size Change.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus

CVE-2019-19338

Kernel: KVM: export MSR_IA32_TSX_CTRL to guest - incomplete fix for TAA (CVE-2019-11135)

A flaw was found in the fix for CVE-2019-11135, in the Linux upstream kernel versions before 5.5 where, the way Intel CPUs handle speculative execution of instructions when a TSX Asynchronous Abort (TAA) error occurs. When a guest is running on a host CPU affected by the TAA flaw (TAA_NO=0), but is not affected by the MDS issue (MDS_NO=1), the guest was to clear the affected buffers by using a VERW instruction mechanism. But when the MDS_NO=1 bit was exported to the guests, the guests did not use the VERW mechanism to clear the affected buffers. This issue affects guests running on Cascade Lake CPUs and requires that host has 'TSX' enabled. Confidentiality of data is the highest threat associated with this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2019-19337

ceph: denial of service in RGW daemon

A flaw was found in Red Hat Ceph Storage version 3 in the way the Ceph RADOS Gateway daemon handles S3 requests. An authenticated attacker can abuse this flaw by causing a remote denial of service by sending a specially crafted HTTP Content-Length header to the Ceph RADOS Gateway server.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Ceph Storage

CVE-2019-19336

ovirt-engine: response_type parameter allows reflected XSS

A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ovirt Redhat

Products

Ovirt-engine Rhev Manager Virtualization

CVE-2019-19335

openshift/installer: kubeconfig and kubeadmin-password are created with word-readable permissions

During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and `kubeadmin-password` files. Both files contain credentials used to authenticate to the OpenShift API server, and are incorrectly assigned word-readable permissions. ose-installer as shipped in Openshift 4.2 is vulnerable.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift

CVE-2019-19334

libyang: stack-based buffer overflow in make_canonical when identityref leaf type is used

In all versions of libyang before 1.0-r5, a stack-based buffer overflow was discovered in the way libyang parses YANG files with a leaf of type "identityref". An application that uses libyang to parse untrusted YANG files may be vulnerable to this flaw, which would allow an attacker to cause a denial of service or possibly gain code execution.

CVSS 3.1 · 9.8 Critical EPSS 3.9% KEV · Not listed

Vendors

Cesnet Fedoraproject Redhat

Products

Libyang Fedora Enterprise Linux