CVE-2020-35514
Last modified
CVE-2020-35514 is a high-severity vulnerability rated 7/10 on the CVSS scale. An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShift cluster. EPSS estimates a 0.22% chance of exploitation in the next 30 days.
Description
An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShift cluster. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects versions before openshift4/ose-machine-config-operator v4.7.0-202105111858.p0.
Metrics
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Openshift | < 4.7.0 |
| Redhat | Openshift | 4.7.0 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1914714Issue Tracking, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1914714Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-35514?
How severe is CVE-2020-35514?
How do I fix CVE-2020-35514?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-35509A flaw was found in keycloak affecting versions 11.0.3 and 1…5.4
- CVE-2020-3551A vulnerability in the web-based management interface of Cis…6.1
- CVE-2020-35510A flaw was found in jboss-remoting in versions before 5.0.20…5.9
- CVE-2020-35511A global buffer overflow was discovered in pngcheck function…7.8
- CVE-2020-35512A use-after-free flaw was found in D-Bus Development branch …7.8
- CVE-2020-35513A flaw incorrect umask during file or directory modification…4.9
- CVE-2020-35515Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-35516Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-35517A flaw was found in qemu. A host privilege escalation issue …8.2
- CVE-2020-35518When binding against a DN during authentication, the reply f…5.3
- CVE-2020-35519An out-of-bounds (OOB) memory access flaw was found in x25_b…7.8
- CVE-2020-3552A vulnerability in the Ethernet packet handling of Cisco Air…7.4
Are you affected by CVE-2020-35514?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST