CVE-2019-14854

2020-01-0716:36:45

CWE-117

redhat

www.cve.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

6.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.4%

JSON

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

CNA Affected

[
  {
    "product": "library-go",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "As shipped with Openshift 4.x"
      }
    ]
  }
]