vulnerability
Red Hat OpenShift: CVE-2019-10150: atomic-openshift: OpenShift builds don't verify SSH Host Keys for the git repository
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 4 | (AV:N/AC:M/Au:N/C:N/I:P/A:N) | Jun 12, 2019 | Oct 15, 2019 | May 10, 2023 |
Severity
4
CVSS
(AV:N/AC:M/Au:N/C:N/I:P/A:N)
Published
Jun 12, 2019
Added
Oct 15, 2019
Modified
May 10, 2023
Description
It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.
Solution(s)
linuxrpm-upgrade-atomic-openshiftlinuxrpm-upgrade-cri-o
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.