CVE-2019-14819CWE-266CWE-270

A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster

High · published January 7, 2020

CVSS v3.0
7.5
EPSS
1%
Percentile
64.7
In the wild
Unconfirmed
What it is

A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespace of the user performing the upgrade. This flaw can allow an unprivileged user to escalate their privileges to those allowed by the privileged Security Context Constraints.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01074 · 64.7th percentile
Weaknesses
CWE-266 · Incorrect Privilege Assignment; CWE-270 · Privilege Context Switching Error
Published
2020-01-07T17:02Z
EPSS history
Timeline
  • 07 JAN 17:02Z
    A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster
    cvelistv5