Vulnerability Details : CVE-2019-6648

On version 1.9.0, If DEBUG logging is enable, F5 Container Ingress Service (CIS) for Kubernetes and Red Hat OpenShift (k8s-bigip-ctlr) log files may contain BIG-IP secrets such as SSL Private Keys and Private key Passphrases as provided as inputs by an AS3 Declaration.

Published 2019-09-04 16:15:11

Updated 2023-02-03 18:40:27

Source F5 Networks

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-6648

Probability of exploitation activity in the next 30 days: 0.04%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 10 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2019-6648

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
1.9	LOW	AV:L/AC:M/Au:N/C:P/I:N/A:N	3.4	2.9	[email protected]
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.4	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	0.8	3.6	[email protected]
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2019-6648

CWE-532 Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Assigned by: [email protected] (Primary)

References for CVE-2019-6648

https://support.f5.com/csp/article/K74327432?utm_source=f5support&utm_medium=RSS

Vendor Advisory
https://support.f5.com/csp/article/K74327432

Vendor Advisory

Products affected by CVE-2019-6648

Redhat » Openshift » Version: N/A
cpe:2.3:a:redhat:openshift:-:*:*:*:*:*:*:*
Matching versions
F5 » Container Ingress Service » Version: 1.9.0
cpe:2.3:a:f5:container_ingress_service:1.9.0:*:*:*:*:*:*:*
Matching versions