vulnerability

Red Hat OpenShift: CVE-2019-10150: atomic-openshift: OpenShift builds don't verify SSH Host Keys for the git repository

Severity
4
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Published
Jun 12, 2019
Added
Oct 15, 2019
Modified
Aug 11, 2025

Description

It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.

Solutions

linuxrpm-upgrade-atomic-openshiftlinuxrpm-upgrade-cri-o
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.