CVE-2019-10214: Insufficiently Protected Credentials
(updated )
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.
References
- lists.opensuse.org/opensuse-security-announce/2020-03/msg00035.html
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html
- bugzilla.redhat.com/show_bug.cgi?id=1732508
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214
- github.com/advisories/GHSA-85p9-j7c9-v4gr
- github.com/containers/image/commit/634605d06e738aec8332bcfd69162e7509ac7aaf
- github.com/containers/image/issues/654
- github.com/containers/image/pull/655
- github.com/containers/image/pull/669
- nvd.nist.gov/vuln/detail/CVE-2019-10214
- pkg.go.dev/vuln/GO-2021-0081
Code Behaviors & Features
Detect and mitigate CVE-2019-10214 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →