CVE-2019-10150

2019-06-1213:42:36

CWE-287

redhat

www.cve.org

CVSS3

5.9

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

AI Score

Confidence

High

EPSS

0.008

Percentile

82.2%

JSON

It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.

CNA Affected

[
  {
    "product": "atomic-openshift",
    "vendor": "redhat",
    "versions": [
      {
        "status": "affected",
        "version": "3.6.x - 4.0.0"
      }
    ]
  }
]