Skip to content
Fencer Vulns
high 7.5

CVE-2019-14819 json

A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster.

published 2020-01-07 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-5948

cvss
7.5
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespace of the user performing the upgrade. This flaw can allow an unprivileged user to escalate their privileges to those allowed by the privileged Security Context Constraints.

Patch / fix

  • openshift-ansible openshift 3.11 3.11.146-1.git.0.fcedb45.el7
  • openshift-ansible-test openshift 3.11 3.11.146-1.git.0.fcedb45.el7
  • openshift-ansible-roles openshift 3.11 3.11.146-1.git.0.fcedb45.el7
  • openshift-ansible-playbooks openshift 3.11 3.11.146-1.git.0.fcedb45.el7

red hat advisories RHSA-2019:2818

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-14819 updated cvss 7.5

openshift-ansible: dockergc service account incorrectly associated with namespace during upgrade

  • Red Hat OpenShift Container Platform 3.10 openshift-ansible, openshift-ansible-roles, openshift-ansible-playbooks
    affected: workaround, no fix available “Make sure your kubeconfig (~/.kube/config) is using the 'default' context when executing, or re-executing a cluster upgrade or install using the ansible playbooks.”
  • Red Hat OpenShift Container Platform 3.11 openshift-ansible 3.11.146-1.git.0.fcedb45.el7, openshift-ansible-test 3.11.146-1.git.0.fcedb45.el7, openshift-ansible-roles 3.11.146-1.git.0.fcedb45.el7, openshift-ansible-playbooks 3.11.146-1.git.0.fcedb45.el7
    fixed: vendor fix “Make sure your kubeconfig (~/.kube/config) is using the 'default' context when executing, or re-executing a cluster upgrade or install using the ansible playbooks.” RHSA-2019:2818
  • Red Hat OpenShift Container Platform 3.9 openshift-ansible, atomic-openshift-utils, openshift-ansible-roles, openshift-ansible-playbooks Red Hat OpenShift Container Platform 4 openshift-ansible, openshift-ansible-test
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.07% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14819 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 7.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • [Red Hat] openshift-ansible

Classification

Weakness
  • CWE-266 Incorrect Privilege Assignment
  • CWE-270 Privilege Context Switching Error
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.