admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-06-08 14:08:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated CVE-2019-3779,3780

Browse Source
This commit is contained in:
DellEMCProductSecurity 2019-03-06 15:06:24 -05:00
parent bfb76ac864
commit 999e00ad3d
2 changed files with 87 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

86
2019/3xxx/CVE-2019-3779.json
View File

@ -1 +1,85 @@
{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ASSIGNER":"secure@dell.com","DATE_PUBLIC":"2019-02-14T21:51:14.000Z","ID":"CVE-2019-3779","STATE":"PUBLIC","TITLE":"Cloud Foundry Container Runtime allows a user to bypass security policy when talking to ETCD"},"source":{"discovery":"UNKNOWN"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Pivotal Container Service (PKS)","version":{"version_data":[{"affected":"<","version_name":"1.2","version_value":"1.2.9"},{"affected":"<","version_name":"1.3","version_value":"1.3.2"}]}}]},"vendor_name":"Pivotal"},{"product":{"product_data":[{"product_name":"Cloud Foundry Container Runtime (CFCR)","version":{"version_data":[{"affected":"<","version_name":"All","version_value":"v0.29.0"}]}}]},"vendor_name":"Cloud Foundry"}]}},"description":{"description_data":[{"lang":"eng","value":"Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Certificate Authority) to sign and trust certs for ETCD as used by the Kubernetes API. This could allow a user authenticated with a cluster to request a signed certificate leveraging the Kubernetes CSR capability to obtain a credential that could escalate privilege access to ETCD.\n"}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-284: Improper Access Control - Generic"}]}]},"references":{"reference_data":[{"refsource":"CONFIRM","url":"https://www.cloudfoundry.org/blog/cve-2019-3779"}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"}}}
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "secure@dell.com",
"DATE_PUBLIC": "2019-02-14T00:00:00.000Z",
"ID": "CVE-2019-3779",
"STATE": "PUBLIC",
"TITLE": "Cloud Foundry Container Runtime allows a user to bypass security policy when talking to ETCD"
},
"source": {
"discovery": "UNKNOWN"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Cloud Foundry Container Runtime (CFCR)",
"version": {
"version_data": [
{
"affected": "<",
"version_name": "All",
"version_value": "v0.29.0"
}
]
}
}
]
},
"vendor_name": "Cloud Foundry"
}
]
}
},
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cloud Foundry Container Runtime, versions prior to 0.29.0, deploys Kubernetes clusters utilize the same CA (Certificate Authority) to sign and trust certs for ETCD as used by the Kubernetes API. This could allow a user authenticated with a cluster to request a signed certificate leveraging the Kubernetes CSR capability to obtain a credential that could escalate privilege access to ETCD.\n"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-284: Improper Access Control - Generic"
}
]
}
]
},
"references": {
"reference_data": [
{
"refsource": "CONFIRM",
"url": "https://www.cloudfoundry.org/blog/cve-2019-3779",
"name": "https://www.cloudfoundry.org/blog/cve-2019-3779"
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
}

23
2019/3xxx/CVE-2019-3780.json
View File

@ -4,7 +4,7 @@
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "secure@dell.com",
"DATE_PUBLIC": "2019-02-14T00:00:00.000Z",
"DATE_PUBLIC": "2019-02-14T19:48:25.155Z",
"ID": "CVE-2019-3780",
"STATE": "PUBLIC",
"TITLE": "Cloud Foundry Container Runtime Leaks IAAS Credentials"
@ -33,25 +33,6 @@
]
},
"vendor_name": "Cloud Foundry"
},
{
"product": {
"product_data": [
{
"product_name": "Pivotal Container Service (PKS)",
"version": {
"version_data": [
{
"affected": "<",
"version_name": "1.3",
"version_value": "1.3.2"
}
]
}
}
]
},
"vendor_name": "Pivotal"
}
]
}
@ -60,7 +41,7 @@
"description_data": [
{
"lang": "eng",
"value": "Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account.\n"
"value": "Cloud Foundry Container Runtime, versions prior to 0.28.0, deploys K8s worker nodes that contains a configuration file with IAAS credentials. A malicious user with access to the k8s nodes can obtain IAAS credentials allowing the user to escalate privileges to gain access to the IAAS account."
}
]
},