CVE-2019-10214
25.11.2019, 11:15
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| buildah_project | buildah | - |
| libpod_project | libpod | - |
| redhat | openshift_container_platform | 4.1 |
| skopeo_project | skopeo | - |
| redhat | enterprise_linux | 8.0 |
| opensuse | leap | 15.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| golang-github-containers-image |
| ||||||||||||||||||||||||
| singularity-container |
|
openSUSE / SLES Releases
openSUSE Product | |||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| buildah |
| ||||||||||||||||||||||||||||
| podman |
| ||||||||||||||||||||||||||||
| podman-cni-config |
| ||||||||||||||||||||||||||||
| podman-docker |
| ||||||||||||||||||||||||||||
| podman-remote |
| ||||||||||||||||||||||||||||
| podmansh |
| ||||||||||||||||||||||||||||
| skopeo |
| ||||||||||||||||||||||||||||
| skopeo-bash-completion |
| ||||||||||||||||||||||||||||
| skopeo-zsh-completion |
|
Common Weakness Enumeration
References