Medium severity · published Jun 12, 2019
CVE-2019-10150
It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds
5.9
CVSS
1.4%
EPSS
No
On KEV
Description
It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OC
Openshift Container Platform · Redhat
3.6 through 4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10150
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10150
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:2989
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:3007
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:3143
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:3811
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10150
Vendor Advisory
https://docs.openshift.com/container-platform/3.11/dev_guide/builds/build_inputs.html#source-secrets-ssh-key-authentication
More from Openshift Container Platform
10.0
CVE-2019-7609
Kibana Arbitrary Code Execution
9.9
CVE-2019-1003029
Jenkins Script Security Plugin Sandbox Bypass Vulnerability
9.9
CVE-2019-1003030
Jenkins Matrix Project Plugin Remote Code Execution Vulnerability
9.8
CVE-2018-1000861
A code execution vulnerability exists in the Stapler web framework used by Jenkins 2.153 and earlier, LTS 2.138.3 and earlier in…
7.8
CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing