{
  "threat_severity" : "Low",
  "public_date" : "2019-04-22T00:00:00Z",
  "bugzilla" : {
    "description" : "kubernetes: Schema info written with world-writeable permissions when cached",
    "id" : "1703209",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1703209"
  },
  "cvss3" : {
    "cvss3_base_score" : "3.3",
    "cvss3_scoring_vector" : "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-732",
  "details" : [ "In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with world-writeable permissions (rw-rw-rw-). If --cache-dir is specified and pointed at a different location accessible to other users/groups, the written files may be modified by other users/groups and disrupt the kubectl invocation.", "A flaw was found in kubectl that leaves http-cache files with read/write permissions for any user. In conjunction with a non-default value for --cache-dir, this may lead to the cache content being placed in a location accessible to other users on the system." ],
  "statement" : "OpenShift Container Platform includes kubectl.  OCP 3.9 and later include this same flaw.\nThis issue does not affect the version of Kubernetes (embedded in heketi) shipped with Red Hat Gluster Storage 3 as it does not contain the vulnerable functionality.",
  "affected_release" : [ {
    "product_name" : "Red Hat OpenShift Container Platform 3.11",
    "release_date" : "2020-01-14T00:00:00Z",
    "advisory" : "RHSA-2020:0020",
    "cpe" : "cpe:/a:redhat:openshift:3.11::el7",
    "package" : "atomic-openshift-0:3.11.161-1.git.0.4ccbe25.el7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.1",
    "release_date" : "2019-11-21T00:00:00Z",
    "advisory" : "RHSA-2019:3942",
    "cpe" : "cpe:/a:redhat:openshift:4.1::el7",
    "package" : "openshift-0:4.1.24-201911080309.git.0.c41acf2.el7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4.1",
    "release_date" : "2020-01-21T00:00:00Z",
    "advisory" : "RHSA-2020:0074",
    "cpe" : "cpe:/a:redhat:openshift:4.1::el7",
    "package" : "openshift4/ose-cli:v4.1.24-201911120311"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat OpenShift Container Platform 3.10",
    "fix_state" : "Affected",
    "package_name" : "atomic-openshift",
    "cpe" : "cpe:/a:redhat:openshift:3.10"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.6",
    "fix_state" : "Not affected",
    "package_name" : "atomic-openshift",
    "cpe" : "cpe:/a:redhat:openshift:3.6"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.7",
    "fix_state" : "Not affected",
    "package_name" : "atomic-openshift",
    "cpe" : "cpe:/a:redhat:openshift:3.7"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 3.9",
    "fix_state" : "Affected",
    "package_name" : "atomic-openshift",
    "cpe" : "cpe:/a:redhat:openshift:3.9"
  }, {
    "product_name" : "Red Hat Storage 3",
    "fix_state" : "Not affected",
    "package_name" : "heketi",
    "cpe" : "cpe:/a:redhat:storage:3"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-11244\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-11244\nhttps://github.com/kubernetes/kubernetes/issues/76676" ],
  "name" : "CVE-2019-11244",
  "mitigation" : {
    "value" : "Do not use --cache-dir, or ensure that --cache-dir is not set to a location that other users have access to.",
    "lang" : "en:us"
  },
  "csaw" : false
}