vulnerability

Red Hat OpenShift: CVE-2019-10150: atomic-openshift: OpenShift builds don't verify SSH Host Keys for the git repository

Severity
4
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Published
Jun 12, 2019
Added
Oct 15, 2019
Modified
May 10, 2023

Description

It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.

Solution(s)

linuxrpm-upgrade-atomic-openshiftlinuxrpm-upgrade-cri-o
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.