CVE-2019-14819

Name of the Vulnerable Software and Affected Versions OpenShift Container Platform versions 3.x

Description A flaw was discovered in the upgrade process of OpenShift Container Platform, specifically when using CRI-O. The issue allows an unprivileged user to escalate their privileges to those allowed by the privileged Security Context Constraints, as the dockergc service account is assigned to the current namespace of the user performing the upgrade.

Recommendations For OpenShift Container Platform versions 3.x, consider restricting the privileges assigned to the dockergc service account during the upgrade process to prevent unauthorized privilege escalation. As a temporary workaround, limit the use of CRI-O during upgrades until a more permanent solution is available.