High severity · published Feb 5, 2019
CVE-2019-3818
The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insecure ciphers and TLS…
7.5
CVSS
0.7%
EPSS
No
On KEV
Description
The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insecure ciphers and TLS 1.0. An attacker could target traffic sent over a TLS connection with a weak configuration and potentially break the encryption.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KU
kube-rbac-proxy · [UNKNOWN]
0.4.1 · source: vendor, NVD
OC
Openshift Container Platform · Redhat
3.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3818
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3818
Third Party Advisory
http://www.securityfocus.com/bid/106744
Vendor Advisory
https://access.redhat.com/errata/RHBA-2019:0327
Vendor Advisory
https://access.redhat.com/security/cve/CVE-2019-3818
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3818