CVE-2020-35514

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-35514
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-35514.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-35514
Published
2021-06-02T14:15:09.577Z
Modified
2026-04-10T04:27:00.546041Z
Severity
  • 7.0 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

An insecure modification flaw in the /etc/kubernetes/kubeconfig file was found in OpenShift. This flaw allows an attacker with access to a running container which mounts /etc/kubernetes or has local access to the node, to copy this kubeconfig file and attempt to add their own node to the OpenShift cluster. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. This flaw affects versions before openshift4/ose-machine-config-operator v4.7.0-202105111858.p0.

References

Affected packages

Git / github.com/openshift/origin

Affected ranges

Type
GIT
Repo
https://github.com/openshift/origin
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b4261e07eda19d9c42aa9d1c748c34f8cba09168
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "openshift4"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.1
v1.0.2
v1.0.3
v1.0.4
v1.0.5
v1.0.6
v1.0.7
v1.0.8
v1.1
v1.1.1
v1.1.3
v1.1.4
v1.1.5
v1.1.6
v1.2.0-rc1
v1.2.0-rc2
v1.3.0
v1.3.0-alpha.0
v1.3.0-alpha.1
v1.3.0-alpha.3
v1.3.0-rc1
v1.4.0-alpha.0
v1.4.0-alpha.1
v1.5.0-alpha.0
v1.5.0-alpha.1
v1.5.0-alpha.2
v1.5.0-alpha.3
v3.*
v3.10.0-alpha.0
v3.10.0-rc.0
v3.11.0-alpha.0
v3.6.0-alpha.0
v3.6.0-alpha.1
v3.6.0-alpha.2
v3.7.0-rc.0
v3.8.0-alpha.0
v3.8.0-alpha.1
v3.9.0-alpha.0
v3.9.0-alpha.1
v3.9.0-alpha.2
v3.9.0-alpha.3
v3.9.0-alpha.4
v4.*
v4.0.0-alpha.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-35514.json"
unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "4.7.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "4.7.0-NA"
            }
        ]
    }
]