CVE-2019-10214: Insufficiently Protected Credentials in github.com/containers/image
Summary
CVE-2019-10214: Insufficiently Protected Credentials in github.com/containers/image. Affects github.com/containers/image versions < 2.0.2-0.20190802080134-634605d06e73+incompatible. Fixed in 2.0.2-0.20190802080134-634605d06e73+incompatible. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/containers/image package is a Go package that provides functionality for working with container images. It allows users to interact with container registries, manage images, and perform various operations related to container images. This package is widely used in the Go ecosystem for container-related tasks.
Vulnerability Detail
The vulnerability identified as CVE-2019-10214 in the github.com/containers/image package involves insufficiently protected credentials. The HTTP client used to connect to the container registry authorization service explicitly disables TLS verification, which means that an attacker who can perform a Man-in-the-Middle (MITM) attack can intercept and steal credentials. This vulnerability poses a significant risk as it allows unauthorized access to sensitive information, potentially leading to unauthorized actions and compromise of container images.
How To Fix
Minimum fixed version
2.0.2-0.20190802080134-634605d06e73+incompatible
This is the first release that contains the fix.
go get github.com/containers/image@v2.0.2-0.20190802080134-634605d06e73+incompatibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually enable TLS verification in the HTTP client used by the github.com/containers/image package. This can be achieved by modifying the code that establishes the HTTP client and enabling TLS verification explicitly. Here's an example of how to enable TLS verification:
import (
"crypto/tls"
"net/http"
)
func main() {
// Create a new HTTP client
client := &http.Client{
Transport: &http.Transport{
TLSClientConfig: &tls.Config{
InsecureSkipVerify: false, // Enable TLS verification
},
},
}
// Use the client for further operations
// ...
}
Conclusion
The vulnerability identified as CVE-2019-10214 in the github.com/containers/image package involves insufficiently protected credentials, allowing an attacker to steal credentials through a Man-in-the-Middle (MITM) attack. To mitigate this vulnerability, it is crucial to update the package to the recommended version or apply the provided workaround. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for github.com/containers/image →
FAQ
This vulnerability allows an attacker who can perform a Man-in-the-Middle (MITM) attack to intercept and steal credentials used for container registry authorization. This can lead to unauthorized access to sensitive information and potential compromise of container images.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. The playground allows you to analyze your application's dependencies without any signup or code installation.
Yes, a fix is available for this vulnerability. It is recommended to update the github.com/containers/image package to version 2.0.2-0.20190802080134-634605d06e73+incompatible or later.
Yes, a workaround is available for this vulnerability. Users can manually enable TLS verification in the HTTP client used by the github.com/containers/image package. Refer to the 'workaround' section for more details.
You can find more information about this vulnerability in the Open Source Vulnerability database at https://pkg.go.dev/vuln/GO-2021-0081.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/containers/image.
