ByteOS Network

NVD Vulnerability Details :

CVE-2019-3818

Analyzed

Source-secalert@redhat.com

Published At-05 Feb, 2019 | 17:29

Updated At-21 May, 2021 | 14:42

The kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowing for use of insecure ciphers and TLS 1.0. An attacker could target traffic sent over a TLS connection with a weak configuration and potentially break the encryption.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Secondary	3.0	3.7	LOW	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary	2.0	5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N

Type: Primary

Version: 3.1

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Type: Secondary

Version: 3.0

Base score: 3.7

Base severity: LOW

Vector:

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Type: Primary

Version: 2.0

Base score: 5.0

Base severity: MEDIUM

Vector:

AV:N/AC:L/Au:N/C:P/I:N/A:N

CPE Matches

kube-rbac-proxy_project>>kube-rbac-proxy>>Versions before 0.4.1(exclusive)

cpe:2.3:a:kube-rbac-proxy_project:kube-rbac-proxy:*:*:*:*:*:*:*:*

Red Hat, Inc.

>>openshift_container_platform>>3.11

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-327	Primary	nvd@nist.gov
CWE-327	Secondary	secalert@redhat.com

CWE ID: CWE-327

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-327

Type: Secondary