CVE-2019-10213

2019-11-2514:21:21

CWE-117

redhat

www.cve.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.6%

JSON

OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

CNA Affected

[
  {
    "product": "openshift",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "versions Red Hat OpenShift 4.1 and Red Hat OpenShift 4.2"
      }
    ]
  }
]