CVE-2019-4143

Vulnerability

IBM Cloud Private versions 3.1.1 and 3.1.2 contain a vulnerability in the Key Management Service (KMS) plugin container. Under default configurations, sensitive data may be written to the container's log files, making it accessible to any local user with the ability to read those logs [1].

Exploitation

An attacker must already have local access to the IBM Cloud Private system (i.e., a valid user account or the ability to execute commands locally). No special privileges beyond standard local user rights are required. The attacker reads the KMS plugin container log files where sensitive information is inadvertently recorded [1].

Impact

Successful exploitation results in the disclosure of sensitive information, which could include cryptographic keys or other secrets managed by the KMS. This compromises confidentiality (C) with no impact on integrity or availability as per the CVSS vector [1].

Mitigation

IBM has released fixes for IBM Cloud Private versions 3.1.1 and 3.1.2. Customers should apply the appropriate update as described in the security bulletin [1]. No workaround is documented in the available references.