CVE-2019-14854

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

OpenShift Container Platform 4 does not sanitize secret data written to static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already been modified in an operator by a privileged user.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-117CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Jan 7, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-148557.5A flaw was found in the way certificate signatures could be forged using collisions found in the SHA-1 algorithm. An attacker could use thisCVE-2019-148566.5ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a NoneCVE-2019-148576.1A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019CVE-2019-148585.5A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub paramCVE-2019-148599.1A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. WithoutCVE-2019-14866.1A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URLCVE-2019-148606.5It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lackCVE-2019-148615.3All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPCCVE-2019-148626.1There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web applicationCVE-2019-148636.1There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web appliCVE-2019-148646.5Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it CVE-2019-148655.9A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by