CVE-2019-10214CWE-522

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container…

Medium · published November 25, 2019

CVSS v3.0
6.4
EPSS
2%
Percentile
75.5
In the wild
Unconfirmed
What it is

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.

The record
Technical detail
CVSS v3.0
6.4 · MEDIUM
Vector
CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01591 · 75.5th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2019-11-25T10:41Z
EPSS history
Timeline
  • 25 NOV 10:41Z
    The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container…
    cvelistv5