CVE-2019-10150

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. An attacker, with the ability to redirect network traffic, could use this to alter the resulting build output.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
redhat	atomic-openshift	3.6.x - 4.0.0

References

Timeline

Published: Jun 12, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101527.2A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attac CVE-2019-101535.0A flaw was discovered in fence-agents, prior to version 4.3.4, where using non-ASCII characters in a guest VM's comment or other fields woul CVE-2019-101547.5A flaw was found in Moodle before versions 3.7, 3.6.4. A web service fetching messages was not restricted to the current user's conversation CVE-2019-101553.1The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity CVE-2019-101565.4A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of CVE-2019-101575.5It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its back CVE-2019-101589.8A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Ses CVE-2019-101594.3cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration CVE-2019-10164.7An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker w CVE-2019-101609.8A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7 CVE-2019-101617.8It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() AP CVE-2019-101627.5A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the serve