CVE-2019-3884 Missing authorization in atomic-openshift

Low 3.6 Published 1 Aug 2019 Updated 4 Aug 2024

Attackers can spoof UUIDs to delete child objects across namespaces in OpenShift, requiring immediate patching to prevent unauthorized data deletion.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2019-3884?

CVE-2019-3884 is a low-severity missing authorization vulnerability in Redhat Openshift, published on 1 Aug 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from another namespace is able to delete children of those objects. Versions 3.6, 3.7, 3.8, 3.9, 3.10, 3.11 and 4.1 are affected.

Weakness: CWE-287, CWE-290

Which versions are affected by CVE-2019-3884?

It affects 1 product.

Products include Redhat Openshift.

How do I fix CVE-2019-3884?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2019-3884 being exploited?

There is no known exploitation of CVE-2019-3884 in the wild and no public exploit code.

All Redhat Openshift vulnerabilities

Sources

Also known as GHSA-fpgq-qv2c-6787.