CVE-2019-10214 containers/image library Insufficiently Protects Credentials
Attackers can intercept unencrypted registry auth traffic to steal credentials or tokens via Man-in-the-Middle attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-10214?
CVE-2019-10214 is a medium-severity vulnerability in Opensuse Leap, published on 25 Nov 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.
Weakness: CWE-522
Which versions are affected by CVE-2019-10214?
3 open source packages ship an affected version, including github.com/containers/image. It affects 6 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/containers/image Go | All versions | 2.0.2-0.20190802080134-634605d06e73+incompatible |
github.com/containers/image Go | All versions | 3.0.0 |
github.com/containers/image Go | All versions | 3.0.0 |
Linux distribution packages (17)
cri-o Red Hat:openshift:3.9::el7 | All versions | 0:1.9.16-5.git858756d.el7 |
cri-o-debuginfo Red Hat:openshift:3.9::el7 | All versions | 0:1.9.16-5.git858756d.el7 |
cri-o Red Hat:openshift:4.1::el7 | All versions | 0:1.13.11-0.4.dev.rhaos4.1.git9cb8f2f.el7 |
cri-o-debuginfo Red Hat:openshift:4.1::el7 | All versions | 0:1.13.11-0.4.dev.rhaos4.1.git9cb8f2f.el7 |
cri-o Red Hat:openshift:4.1::el8 | All versions | 0:1.13.11-0.7.dev.rhaos4.1.git9cb8f2f.el8 |
cri-o-debuginfo Red Hat:openshift:4.1::el8 | All versions | 0:1.13.11-0.7.dev.rhaos4.1.git9cb8f2f.el8 |
cri-o-debugsource Red Hat:openshift:4.1::el8 | All versions | 0:1.13.11-0.7.dev.rhaos4.1.git9cb8f2f.el8 |
buildah SUSE:Linux Enterprise Module for Containers 15 SP1 | All versions | 1.7.1-3.3.1 |
podman SUSE:Linux Enterprise Module for Containers 15 SP1 | All versions | 1.4.4-4.11.1 |
skopeo SUSE:Linux Enterprise Module for Server Applications 15 | All versions | 0.1.32-4.8.1 |
skopeo SUSE:Linux Enterprise Module for Server Applications 15 SP1 | All versions | 0.1.32-4.8.1 |
skopeo SUSE:Linux Enterprise Module for Server Applications 15 SP1 | All versions | 0.1.41-4.11.1 |
skopeo openSUSE:Leap 15.0 | All versions | 0.1.32-lp150.8.1 |
buildah openSUSE:Leap 15.1 | All versions | 1.7.1-lp151.2.3.1 |
podman openSUSE:Leap 15.1 | All versions | 1.4.4-lp151.3.6.1 |
skopeo openSUSE:Leap 15.1 | All versions | 0.1.32-lp151.2.3.1 |
skopeo openSUSE:Leap 15.1 | All versions | 0.1.41-lp151.2.6.1 |
Products include Buildah Project Buildah, Libpod Project Libpod, Opensuse Leap, Redhat Enterprise Linux, Redhat Openshift Container Platform, Skopeo Project Skopeo.
How do I fix CVE-2019-10214?
Upgrade github.com/containers/image to a fixed version for your release line: 2.0.2-0.20190802080134-634605d06e73+incompatible or 3.0.0.
Is CVE-2019-10214 being exploited?
There is no known exploitation of CVE-2019-10214 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Leap
- CVE-2020-10696 Path Traversal in Buildah
- CVE-2024-9675 Buildah: buildah allows arbitrary directory mount
- CVE-2022-2990 Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
- CVE-2022-27651 Non-empty default inheritable capabilities for linux container in Buildah
- CVE-2021-3602 Buildah processes using chroot isolation may leak environment values to intermediate processes
Sources
Also known as GHSA-85p9-j7c9-v4gr, GO-2021-0081, RHSA-2019:2825, RHSA-2019:3812, SUSE-SU-2019:2340-1, SUSE-SU-2019:2341-1 and 8 more.