CVE-2019-14819: [red hat] openshift-ansible Incorrect Privilege Assignment

Vulnerability summary

CVE-2019-14819 is a high (CVSS 8.8) Incorrect Privilege Assignment vulnerability in [red hat] openshift-ansible. EPSS estimates a 1.07% chance of exploitation in the next 30 days, higher than 64.3% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-01-2020
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespace of the user performing the upgrade. This flaw can allow an unprivileged user to escalate their privileges to those allowed by the privileged Security Context Constraints.

• CWE-266Incorrect Privilege AssignmentA product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
• CWE-270Privilege Context Switching ErrorThe product does not properly manage privileges while it is switching between different contexts that have different privileges or spheres of control.
• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.