The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- CVSS 3.0 Base Score: 6.4
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade oci-umountUpgrade fuse-overlayfsUpgrade oci-systemd-hook | May 13, 2022 | Nov 25, 2019 |
| Centos_linux | — | Upgrade podman-debuginfoUpgrade runc-debuginfoUpgrade skopeo-debuginfoUpgrade oci-systemd-hookUpgrade container-selinuxUpgrade oci-systemd-hook-debuginfoUpgrade podman-remoteUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netnsUpgrade slirp4netns-debugsourceUpgrade toolboxUpgrade runcUpgrade buildah-debugsourceUpgrade containernetworking-pluginsUpgrade podman-remote-debuginfoUpgrade podman-testsUpgrade containernetworking-plugins-debugsourceUpgrade skopeo-testsUpgrade oci-umount-debugsourceUpgrade slirp4netns-debuginfoUpgrade podman-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade podman-manpagesUpgrade podman-dockerUpgrade buildah-testsUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade buildah-debuginfoUpgrade oci-umountUpgrade oci-umount-debuginfoUpgrade buildahUpgrade skopeoUpgrade runc-debugsourceUpgrade cockpit-podmanUpgrade containers-commonUpgrade podmanUpgrade fuse-overlayfsUpgrade python-podman-apiUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debugsource | Nov 6, 2019 | Nov 5, 2019 |
| Oracle_linux | — | Upgrade containernetworking-pluginsUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade oci-systemd-hookUpgrade podmanUpgrade podman-remoteUpgrade buildahUpgrade containers-commonUpgrade python-podman-apiUpgrade podman-manpagesUpgrade cockpit-podmanUpgrade podman-dockerUpgrade slirp4netnsUpgrade runcUpgrade container-selinuxUpgrade skopeoUpgrade podman-testsUpgrade skopeo-testsUpgrade oci-umount | Jul 22, 2024 | Sep 9, 2019 |
| Redhat Openshift | — | Upgrade cri-oUpgrade atomic-openshift | Oct 8, 2019 | Sep 9, 2019 |
| Redhat_linux | — | Upgrade podman-debuginfoUpgrade buildahUpgrade podmanUpgrade buildah-tests-debuginfoUpgrade podman-remote-debuginfoUpgrade fuse-overlayfsUpgrade buildah-debuginfoUpgrade containers-commonUpgrade oci-umount-debuginfoUpgrade podman-remoteUpgrade runc-debugsourceUpgrade runc-debuginfoUpgrade containernetworking-pluginsUpgrade fuse-overlayfs-debugsourceUpgrade oci-umountUpgrade skopeoUpgrade oci-systemd-hook-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade python-podman-apiUpgrade skopeo-debuginfoUpgrade buildah-debugsourceUpgrade buildah-testsUpgrade runcUpgrade slirp4netns-debugsourceUpgrade podman-manpagesUpgrade podman-testsUpgrade podman-debugsourceUpgrade slirp4netnsUpgrade podman-dockerUpgrade cockpit-podmanUpgrade containernetworking-plugins-debugsourceUpgrade oci-umount-debugsourceUpgrade skopeo-testsUpgrade slirp4netns-debuginfoUpgrade toolboxUpgrade skopeo-debugsourceUpgrade oci-systemd-hookUpgrade oci-systemd-hook-debuginfoUpgrade container-selinuxUpgrade fuse-overlayfs-debuginfo | Nov 6, 2019 | Nov 5, 2019 |
| Rocky_linux | — | Upgrade fuse-overlayfsUpgrade oci-umount-debuginfoUpgrade oci-umount-debugsourceUpgrade oci-systemd-hook-debugsourceUpgrade oci-systemd-hook-debuginfoUpgrade oci-systemd-hookUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade oci-umount | Mar 12, 2024 | Nov 25, 2019 |
| Suse | — | Upgrade kubernetes-kubelet1.17Upgrade go1.14-raceUpgrade skopeoUpgrade kubernetes-apiserverUpgrade kubernetes-kubeadmUpgrade kubernetes-schedulerUpgrade podmanUpgrade kubernetes-clientUpgrade podman-cni-configUpgrade kubernetes-kubelet-commonUpgrade kubernetes-nodeUpgrade buildahUpgrade go1.14Upgrade kubernetes-kubelet1.18Upgrade cri-oUpgrade libcontainers-commonUpgrade cri-o-kubeadm-criconfigUpgrade kubernetes-masterUpgrade go1.14-docUpgrade kubernetes-proxyUpgrade kubernetes-controller-managerUpgrade cri-tools | Sep 17, 2019 | Sep 10, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub