Read the docs
TI-2019-07534 Aliases CVE-2019-10214GHSA-85p9-j7c9-v4gr

Insufficiently protected credentials in containers/image

Priority LOW 30CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 5 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-522.

Summary

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.

Why it matters now

EPSS 0.01591 75th percentileScored 2026-11-07
Fix Partial github.com/containers/image (Go): 3.0.0Red Hat: 7 advisoriesRed Hat: 5 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—containers/image3.0.0—No fix listedCNA
—github.com/containers/image (Go)before 3.0.03.0.0Patch availableGHSA-85p9-j7c9-v4gr
  • containers/image Vendor— Affected 3.0.0 Fixed in — No fix listed CNA
  • github.com/containers/image (Go) Vendor— Affected before 3.0.0 Fixed in 3.0.0 Patch available GHSA-85p9-j7c9-v4gr

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:buildah_project:buildah:-:*:*:*:*:*:*:*not specified by NVDVulnerableBuildah Project
cpe:2.3:a:libpod_project:libpod:-:*:*:*:*:*:*:*not specified by NVDVulnerableLibpod Project
cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*4.1VulnerableRed Hat
cpe:2.3:a:skopeo_project:skopeo:-:*:*:*:*:*:*:*not specified by NVDVulnerableSkopeo Project
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0VulnerableRed Hat
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
  • cpe:2.3:a:buildah_project:buildah:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Buildah Project
  • cpe:2.3:a:libpod_project:libpod:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Libpod Project
  • cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
  • cpe:2.3:a:skopeo_project:skopeo:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Skopeo Project
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE

Remediation

  • Fix · GHSA-85p9-j7c9-v4gr github.com/containers/image (Go) Fixed in 3.0.0 Advisory →

Red Hat 7 advisories

  • RHSA-2019:3812 Released 2019-11-07 · Red Hat rating Moderate
    OpenShift Container Platform 3.9 cri-o security update
    • Red Hat OpenShift Container Platform 3.9 cri-o-1.9.16-5.git858756d.el7
  • RHSA-2019:3494 Released 2019-11-05 · Red Hat rating Important
    container-tools:1.0 security and bug fix update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.5-5.gite94b4f9.module+el8.1.0+4241+a7060183.aarch64::container-tools:1.0, buildah-1.5-5.gite94b4f9.module+el8.1.0+4241+a7060183.ppc64le::container-tools:1.0, buildah-1.5-5.gite94b4f9.module+el8.1.0+4241+a7060183.s390x::container-tools:1.0 +47
  • RHSA-2019:3403 Released 2019-11-05 · Red Hat rating Important
    container-tools:rhel8 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.aarch64::container-tools:rhel8, buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.ppc64le::container-tools:rhel8, buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.s390x::container-tools:rhel8 +47
Show 4 more Red Hat advisories
  • RHSA-2019:3007 Released 2019-10-16 · Red Hat rating Moderate
    OpenShift Container Platform 4.1.20 openshift-enterprise-builder-container security update
    • Red Hat OpenShift Container Platform 4.1 openshift4/ose-docker-builder
  • RHSA-2019:2989 Released 2019-10-14 · Red Hat rating Moderate
    OpenShift Container Platform 3.10 atomic-openshift kube-apiserver security update
    • Red Hat OpenShift Container Platform 3.10 atomic-openshift-3.10.175-1.git.0.f9f0e81.el7, atomic-openshift-clients-3.10.175-1.git.0.f9f0e81.el7, atomic-openshift-clients-redistributable-3.10.175-1.git.0.f9f0e81.el7 +11
  • RHSA-2019:2825 Released 2019-09-25 · Red Hat rating Moderate
    OpenShift Container Platform 4.1.17 cri-o security update
    • Red Hat OpenShift Container Platform 4.1 cri-o-1.13.11-0.4.dev.rhaos4.1.git9cb8f2f.el7, cri-o-1.13.11-0.7.dev.rhaos4.1.git9cb8f2f.el8
  • RHSA-2019:2817 Released 2019-09-23 · Red Hat rating Moderate
    OpenShift Container Platform 3.11 security update
    • Red Hat OpenShift Container Platform 3.11 cri-o-1.11.16-0.2.dev.rhaos3.11.git3f89eba.el7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2019:3403, RHSA-2019:3494
Red Hat OpenShift Container Platform 3.10Fixed RHSA-2019:2989
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2019:2817
Red Hat OpenShift Container Platform 3.9Fixed RHSA-2019:3812
Red Hat OpenShift Container Platform 4.1Fixed RHSA-2019:2825, RHSA-2019:3007

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-10214
  2. 2026-10-03 Alias added: GHSA-85p9-j7c9-v4gr

References

Patch 1

Advisory 3

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences