Lucene search

[email protected]CVE-2020-1706

HistoryMar 09, 2020 - 4:15 p.m.

CVE-2020-1706

2020-03-0916:15:12

CWE-732

[email protected]

web.nvd.nist.gov

cve-2020-1706

privilege escalation

openshift

container security

nvd

7 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.4 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

12.5%

JSON

It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/apb-tools-container.

Affected configurations

Vulners

NVD

Node

redhatopenshift_container_platformRange≤3.11

redhatopenshift_container_platformRange≤4.1

redhatopenshift_container_platformRange≤4.3

VendorProductVersionCPE
redhatopenshift_container_platform*cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
redhatopenshift_container_platform*cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*
redhatopenshift_container_platform*cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	openshift_container_platform	*	cpe:2.3:a:redhat:openshift_container_platform::::::::
redhat	openshift_container_platform	*	cpe:2.3:a:redhat:openshift_container_platform::::::::
redhat	openshift_container_platform	*	cpe:2.3:a:redhat:openshift_container_platform::::::::

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "openshift/apb-tools-container",
    "versions": [
      {
        "version": "openshift-enterprise version 3.11",
        "status": "affected"
      },
      {
        "version": "from openshift-enterprise version 4.1 to, including 4.3",
        "status": "affected"
      }
    ]
  }
]