CVE-2019-19335CWE-732

During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and…

Medium · published March 18, 2020

CVSS v3.0
4.4
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and `kubeadmin-password` files. Both files contain credentials used to authenticate to the OpenShift API server, and are incorrectly assigned word-readable permissions. ose-installer as shipped in Openshift 4.2 is vulnerable.

The record
Technical detail
CVSS v3.0
4.4 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.5th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2020-03-18T15:45Z
EPSS history
Timeline
  • 18 MAR 15:45Z
    During installation of an OpenShift 4 cluster, the `openshift-install` command line tool creates an `auth` directory, with `kubeconfig` and…
    cvelistv5