VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 25, 2019· Updated Aug 4, 2024

CVE-2019-10214

CVE-2019-10214

Description

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The containers/image library does not enforce TLS for registry authorization token requests, allowing credentials theft via MiTM.

Vulnerability

Analysis

The containers/image library, used by container tools Podman, Buildah, Skopeo in Red Hat Enterprise Linux 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections when contacting the container registry authorization service [1][2][3]. This means that login credentials (username and password) and bearer tokens are transmitted over unencrypted HTTP instead of HTTPS when the token server is contacted [3][4]. The root cause is the use of different HTTP clients for contacting the bearer token server and the registry; the token server client was not enforcing TLS [1].

Exploitation

An attacker with a position to perform a man-in-the-middle (MiTM) attack on the network path between the container tool and the token server can intercept the unencrypted communication [2][3]. No authentication is needed beyond the network access. The attack surface includes any environment where a container tool authenticates to a registry that uses an external token service over a non-TLS connection.

Impact

Successful exploitation allows the attacker to steal login credentials or bearer tokens [2][3]. With these credentials, the attacker can authenticate to the container registry as the victim and potentially pull or push images, or access other resources protected by the same credentials.

Mitigation

The vulnerability was addressed by an upstream pull request that uses the same TLS-enabled HTTP client for both the registry and the token server [1]. Red Hat released fixes for OpenShift Container Platform 3.11 via RHSA-2019:2817 [3][4]. Users should ensure they are using patched versions of the containers/image library and associated tools.

References
  1. Use the same HTTP client for contacting the bearer token server and the registry by mtrmac · Pull Request #669 · containers/image
  2. NVD - CVE-2019-10214
  3. not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure
  4. not enforcing TLS when sending username+password credentials to token servers leading to credential disclosure

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/containers/imageGo
< 3.0.03.0.0

Affected products

27

Patches

1
634605d06e73

Merge pull request #669 from mtrmac/bearer-token-tls

https://github.com/containers/imageValentin RothbergAug 2, 2019via ghsa
commit
1 file changed · +1 −5
  • docker/docker_client.go+1 −5 modified
    @@ -526,11 +526,7 @@ func (c *dockerClient) getBearerToken(ctx context.Context, challenge challenge,
 		authReq.SetBasicAuth(c.username, c.password)
 	}
 	logrus.Debugf("%s %s", authReq.Method, authReq.URL.String())
-	tr := tlsclientconfig.NewTransport()
-	// TODO(runcom): insecure for now to contact the external token service
-	tr.TLSClientConfig = &tls.Config{InsecureSkipVerify: true}
-	client := &http.Client{Transport: tr}
-	res, err := client.Do(authReq)
+	res, err := c.client.Do(authReq)
 	if err != nil {
 		return nil, err
 	}

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.