CVE-2019-19346 Privilege escalation in openshift/mariadb-apb

High 7.0 Published 2 Apr 2020 Updated 5 Aug 2024

An attacker with container access can modify /etc/passwd to escalate privileges in the OpenShift MariaDB APB.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-19346?

CVE-2019-19346 is a high-severity vulnerability in Redhat Openshift, published on 2 Apr 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/mariadb-apb, affecting versions before the following 4.3.5, 4.2.21, 4.1.37, and 3.11.188-4 . An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

Weakness: CWE-269, CWE-266

Which versions are affected by CVE-2019-19346?

It affects 1 product.

Products include Redhat Openshift.

How do I fix CVE-2019-19346?

No fix has been published for CVE-2019-19346 yet. Limit exposure of the affected software until one is available.

Is CVE-2019-19346 being exploited?

There is no known exploitation of CVE-2019-19346 in the wild and no public exploit code.

All Redhat Openshift vulnerabilities

Sources

Also known as GHSA-983g-8wfp-4rwm.