CVE-2019-10150 Security feature bypass in atomic-openshift
An attacker can redirect network traffic to bypass SSH host key checking during builds, allowing them to alter the resulting build output.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-10150?
CVE-2019-10150 is a medium-severity vulnerability in Redhat Openshift Container Platform, published on 12 Jun 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.
Weakness: CWE-287
Which versions are affected by CVE-2019-10150?
It affects 1 product.
Linux distribution packages (13)
atomic-openshift Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
atomic-openshift-clients Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
atomic-openshift-clients-redistributable Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
atomic-openshift-docker-excluder Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
atomic-openshift-excluder Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
atomic-openshift-hyperkube Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
atomic-openshift-hypershift Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
atomic-openshift-master Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
atomic-openshift-node Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
atomic-openshift-pod Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
atomic-openshift-sdn-ovs Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
atomic-openshift-template-service-broker Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
atomic-openshift-tests Red Hat:openshift:3.11::el7 | All versions | 0:3.11.153-1.git.0.aaf3f71.el7 |
Products include Redhat Openshift Container Platform.
How do I fix CVE-2019-10150?
Apply the vendor's patch.
Is CVE-2019-10150 being exploited?
There is no known exploitation of CVE-2019-10150 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openshift Container Platform
- CVE-2020-27836 Missing authorization in cluster-ingress-operator
- CVE-2018-1085 Misconfiguration in openshift-ansible
- CVE-2026-54099 Privilege escalation in Red Hat OpenShift Container Platform 4
- CVE-2026-1784 Ose-cluster-ingress-operator: remote code execution through haproxy configuration injection
- CVE-2021-20182 Privilege escalation in openshift
Sources
Also known as GHSA-ccwq-5269-25p2, RHSA-2019:3143.