The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Buildah | Buildah_project | - (including) | - (including) |
| Libpod | Libpod_project | - (including) | - (including) |
| Openshift_container_platform | Redhat | 4.1 (including) | 4.1 (including) |
| Skopeo | Skopeo_project | - (including) | - (including) |
| Enterprise_linux | Redhat | 8.0 (including) | 8.0 (including) |
| Red Hat Enterprise Linux 8 | RedHat | container-tools:rhel8-8010020190927090915.4985cc55 | * |
| Red Hat Enterprise Linux 8 | RedHat | container-tools:1.0-8010020190927091243.4985cc55 | * |
| Red Hat OpenShift Container Platform 3.10 | RedHat | atomic-openshift-0:3.10.175-1.git.0.f9f0e81.el7 | * |
| Red Hat OpenShift Container Platform 3.10 | RedHat | cri-o-0:1.10.6-2.rhaos3.10.git56d7d9a.el7 | * |
| Red Hat OpenShift Container Platform 3.11 | RedHat | cri-o-0:1.11.16-0.2.dev.rhaos3.11.git3f89eba.el7 | * |
| Red Hat OpenShift Container Platform 3.9 | RedHat | cri-o-0:1.9.16-5.git858756d.el7 | * |
| Red Hat OpenShift Container Platform 4.1 | RedHat | cri-o-0:1.13.11-0.4.dev.rhaos4.1.git9cb8f2f.el7 | * |
| Red Hat OpenShift Container Platform 4.1 | RedHat | openshift4/ose-docker-builder:v4.1.20-201910102034 | * |
| Golang-github-containers-image | Ubuntu | groovy | * |
| Golang-github-containers-image | Ubuntu | hirsute | * |
| Golang-github-containers-image | Ubuntu | impish | * |
| Golang-github-containers-image | Ubuntu | kinetic | * |
| Golang-github-containers-image | Ubuntu | lunar | * |
| Golang-github-containers-image | Ubuntu | mantic | * |
| Golang-github-containers-image | Ubuntu | trusty | * |
| Singularity-container | Ubuntu | bionic | * |
| Singularity-container | Ubuntu | trusty | * |
| Singularity-container | Ubuntu | upstream | * |