GO-2021-0081

vendorUSosv

Insufficiently Protected Credentials in github.com/containers/image

view advisory published 2021-04-14Licence: per source

The HTTP client used to connect to the container registry authorization service explicitly disables TLS verification, allowing an attacker that is able to MITM the connection to steal credentials.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-10214US	medium5.9	1.59% (76th)	—	2019-11-25
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enfor…

references

External citations — patches, advisories, analysis.

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10214WEB
https://github.com/containers/image/commit/634605d06e738aec8332bcfd69162e7509ac7aafFIX
https://github.com/containers/image/issues/654WEB
https://github.com/containers/image/pull/669FIX

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan