Vulnerability Description
The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insecure ciphers and TLS 1.0. An attacker could target traffic sent over a TLS connection with a weak configuration and potentially break the encryption.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kube-Rbac-Proxy Project | Kube-Rbac-Proxy | < 0.4.1 |
| Redhat | Openshift Container Platform | 3.11 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/106744Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHBA-2019:0327Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2019-3818Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3818Issue TrackingPatchVendor Advisory
- http://www.securityfocus.com/bid/106744Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHBA-2019:0327Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2019-3818Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3818Issue TrackingPatchVendor Advisory
FAQ
What is CVE-2019-3818?
CVE-2019-3818 is a vulnerability with a CVSS score of 7.5 (HIGH). The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insecure ciphers and TLS 1.0. An attacker coul...
How severe is CVE-2019-3818?
CVE-2019-3818 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-3818?
Check the references section above for vendor advisories and patch information. Affected products include: Kube-Rbac-Proxy Project Kube-Rbac-Proxy, Redhat Openshift Container Platform.