CVE-2019-10214

MEDIUM

Containers/image - Info Disclosure

Title source: llm

Description

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.

References (3)

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00035.html

[Mailing List, Third Party Advisory] http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00041.html

[Issue Tracking, Patch, Vendor Advisory] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214

Scores

CVSS v3 5.9

EPSS 0.0047

EPSS Percentile 64.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-522

Status published

Affected Products (7)

buildah_project/buildah

libpod_project/libpod

redhat/openshift_container_platform

skopeo_project/skopeo

redhat/enterprise_linux

opensuse/leap

containers/image < 3.0.0Go

Timeline

Published Nov 25, 2019

Tracked Since Feb 18, 2026