CVE-2019-14819 Privilege escalation in openshift-ansible

High 7.5 Published 7 Jan 2020 Updated 5 Aug 2024

An unprivileged user can escalate privileges to privileged Security Context Constraints during an OpenShift cluster upgrade via CRI-O.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-14819?

CVE-2019-14819 is a high-severity vulnerability in Redhat Openshift Container Platform, published on 7 Jan 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespace of the user performing the upgrade. This flaw can allow an unprivileged user to escalate their privileges to those allowed by the privileged Security Context Constraints.

Weakness: CWE-269, CWE-270, CWE-266

Which versions are affected by CVE-2019-14819?

It affects 1 product.

Linux distribution packages (5)

`openshift-ansible` Red Hat:openshift:3.11::el7	All versions	`0:3.11.146-1.git.0.fcedb45.el7`
`openshift-ansible-docs` Red Hat:openshift:3.11::el7	All versions	`0:3.11.146-1.git.0.fcedb45.el7`
`openshift-ansible-playbooks` Red Hat:openshift:3.11::el7	All versions	`0:3.11.146-1.git.0.fcedb45.el7`
`openshift-ansible-roles` Red Hat:openshift:3.11::el7	All versions	`0:3.11.146-1.git.0.fcedb45.el7`
`openshift-ansible-test` Red Hat:openshift:3.11::el7	All versions	`0:3.11.146-1.git.0.fcedb45.el7`

Products include Redhat Openshift Container Platform.

How do I fix CVE-2019-14819?

Apply the vendor's patch.

Is CVE-2019-14819 being exploited?

There is no known exploitation of CVE-2019-14819 in the wild and no public exploit code.

All Redhat Openshift Container Platform vulnerabilities

Sources

Also known as GHSA-37jw-xgjq-3fmq, RHSA-2019:2818.