
CVE catalog
CVE-2019-10214
golang-github-containers-image affected and fixed versions
The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.
- Severity
- Critical · CVSS 9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.59% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Opensusetumbleweed | buildah | 1.23.0-1.1 | UnknownSource applicability is not established | [OPENSUSE-SU-2024:10666-1] |
| Debiantrixie | golang-github-containers-image | Not reported | Not affectedDistribution reports not affected | [CVE-2019-10214] |
| Debiantrixie | golang-github-containers-image | 5.34.2-1 | Not affected | [CVE-2019-10214] |
| Debiansid | golang-github-containers-image | Not reported | Not affectedDistribution reports not affected | [CVE-2019-10214] |
| Debiansid | golang-github-containers-image | 5.39.2-3 | Not affected | [CVE-2019-10214] |
| Suselinux enterprise module for server applications 15 sp1 | skopeo | 0.1.32-4.8.1 | UnknownSource applicability is not established | [SUSE-SU-2019:2340-1] |
| Suselinux enterprise module for server applications 15 sp1 | skopeo | 0.1.41-4.11.1 | UnknownSource applicability is not established | [SUSE-SU-2020:0712-1] |
| Suselinux enterprise module for server applications 15 | skopeo | 0.1.32-4.8.1 | UnknownSource applicability is not established | [SUSE-SU-2019:2340-1] |
| Suselinux enterprise module for containers 15 sp3 | buildah | 1.23.1-150300.8.3.1 | UnknownSource applicability is not established | [SUSE-SU-2022:0770-1] |
| Suselinux enterprise module for containers 15 sp2 | buildah | 1.17.0-3.6.1 | UnknownSource applicability is not established | [SUSE-SU-2020:3423-1] |
| Suselinux enterprise module for containers 15 sp1 | buildah | 1.17.0-3.6.1 | UnknownSource applicability is not established | [SUSE-SU-2020:3423-1] |
| Suselinux enterprise module for containers 15 sp1 | buildah | 1.7.1-3.3.1 | UnknownSource applicability is not established | [SUSE-SU-2019:2341-1] |
Showing 12 observations. All 27 observations, including unknown and conflicting reports, are available below.
Provider details and historical evidence
| Distribution / release | Package | Version | Status | Source |
|---|---|---|---|---|
| Debianbookworm | golang-github-containers-image | Not reported | Not affectedDistribution reports not affected | [CVE-2019-10214] |
| Debianbookworm | golang-github-containers-image | 5.23.1-4 | Not affected | [CVE-2019-10214] |
| Debianforky | golang-github-containers-image | Not reported | Not affectedDistribution reports not affected | [CVE-2019-10214] |
| Debianforky | golang-github-containers-image | 5.39.2-3 | Not affected | [CVE-2019-10214] |
| Debiansid | golang-github-containers-image | Not reported | Not affectedDistribution reports not affected | [CVE-2019-10214] |
| Debiansid | golang-github-containers-image | 5.39.2-3 | Not affected | [CVE-2019-10214] |
| Debiantrixie | golang-github-containers-image | Not reported | Not affectedDistribution reports not affected | [CVE-2019-10214] |
| Debiantrixie | golang-github-containers-image | 5.34.2-1 | Not affected | [CVE-2019-10214] |
| Opensuseleap 15.0 | skopeo | 0.1.32-lp150.8.1 | UnknownSource applicability is not established | [OPENSUSE-SU-2019:2159-1] |
| Opensuseleap 15.1 | buildah | 1.17.0-lp151.2.6.1 | UnknownSource applicability is not established | [OPENSUSE-SU-2020:2106-1] |
| Opensuseleap 15.1 | buildah | 1.7.1-lp151.2.3.1 | UnknownSource applicability is not established | [OPENSUSE-SU-2019:2137-1] |
| Opensuseleap 15.1 | podman | 1.4.4-lp151.3.6.1 | UnknownSource applicability is not established | [OPENSUSE-SU-2019:2143-1] |
| Opensuseleap 15.1 | skopeo | 0.1.32-lp151.2.3.1 | UnknownSource applicability is not established | [OPENSUSE-SU-2019:2138-1] |
| Opensuseleap 15.1 | skopeo | 0.1.41-lp151.2.6.1 | UnknownSource applicability is not established | [OPENSUSE-SU-2020:0377-1] |
| Opensuseleap 15.2 | buildah | 1.19.2-lp152.2.3.1 | UnknownSource applicability is not established | [OPENSUSE-SU-2021:0310-1] |
| Opensuseleap 15.2 | libcontainers-common | 20210112-lp152.2.6.1 | UnknownSource applicability is not established | [OPENSUSE-SU-2021:0310-1] |
| Opensuseleap 15.2 | podman | 2.2.1-lp152.4.9.1 | UnknownSource applicability is not established | [OPENSUSE-SU-2021:0310-1] |
| Opensuseleap 15.3 | buildah | 1.23.1-150300.8.3.1 | UnknownSource applicability is not established | [OPENSUSE-SU-2022:0770-1] |
| Opensusetumbleweed | buildah | 1.23.0-1.1 | UnknownSource applicability is not established | [OPENSUSE-SU-2024:10666-1] |
| Suselinux enterprise module for containers 15 sp1 | buildah | 1.17.0-3.6.1 | UnknownSource applicability is not established | [SUSE-SU-2020:3423-1] |
| Suselinux enterprise module for containers 15 sp1 | buildah | 1.7.1-3.3.1 | UnknownSource applicability is not established | [SUSE-SU-2019:2341-1] |
| Suselinux enterprise module for containers 15 sp1 | podman | 1.4.4-4.11.1 | UnknownSource applicability is not established | [SUSE-SU-2019:2346-1] |
| Suselinux enterprise module for containers 15 sp2 | buildah | 1.17.0-3.6.1 | UnknownSource applicability is not established | [SUSE-SU-2020:3423-1] |
| Suselinux enterprise module for containers 15 sp3 | buildah | 1.23.1-150300.8.3.1 | UnknownSource applicability is not established | [SUSE-SU-2022:0770-1] |
| Suselinux enterprise module for server applications 15 | skopeo | 0.1.32-4.8.1 | UnknownSource applicability is not established | [SUSE-SU-2019:2340-1] |
| Suselinux enterprise module for server applications 15 sp1 | skopeo | 0.1.32-4.8.1 | UnknownSource applicability is not established | [SUSE-SU-2019:2340-1] |
| Suselinux enterprise module for server applications 15 sp1 | skopeo | 0.1.41-4.11.1 | UnknownSource applicability is not established | [SUSE-SU-2020:0712-1] |
Original provider fields
{
"package_releases": [
{
"name": "golang-github-containers-image",
"status": "not affected",
"release": "sid",
"version": "5.39.2-3"
},
{
"name": "golang-github-containers-image",
"status": "not affected",
"release": "forky",
"version": "5.39.2-3"
},
{
"name": "golang-github-containers-image",
"status": "not affected",
"release": "trixie",
"version": "5.34.2-1"
},
{
"name": "golang-github-containers-image",
"status": "not affected",
"release": "bookworm",
"version": "5.23.1-4"
}
],
"fixed_versions": [
{
"bug": null,
"name": "golang-github-containers-image",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "unimportant",
"fixed_version": "0"
},
{
"bug": null,
"name": "golang-github-containers-image",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "unimportant",
"fixed_version": "0"
},
{
"bug": null,
"name": "golang-github-containers-image",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "unimportant",
"fixed_version": "0"
},
{
"bug": null,
"name": "golang-github-containers-image",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "unimportant",
"fixed_version": "0"
}
],
"distribution_packages": [
{
"name": "skopeo",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.32-lp150.8.1"
}
]
}
],
"release": "leap 15.0",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:2159-1",
"fixed_version": "0.1.32-lp150.8.1",
"provider_source": "pypi",
"provider_record_id": "OPENSUSE-SU-2019:2159-1",
"provider_updated_at": "2026-02-04T04:18:06.843744Z",
"applicability_unknown": true
},
{
"name": "skopeo",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.32-4.8.1"
}
]
}
],
"release": "linux enterprise module for server applications 15",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2340-1",
"fixed_version": "0.1.32-4.8.1",
"provider_source": "pypi",
"provider_record_id": "SUSE-SU-2019:2340-1",
"provider_updated_at": "2026-02-04T04:13:44.327325Z",
"applicability_unknown": true
},
{
"name": "skopeo",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.32-4.8.1"
}
]
}
],
"release": "linux enterprise module for server applications 15 sp1",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2340-1",
"fixed_version": "0.1.32-4.8.1",
"provider_source": "pypi",
"provider_record_id": "SUSE-SU-2019:2340-1",
"provider_updated_at": "2026-02-04T04:13:44.327325Z",
"applicability_unknown": true
},
{
"name": "buildah",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.17.0-lp151.2.6.1"
}
]
}
],
"release": "leap 15.1",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2020:2106-1",
"fixed_version": "1.17.0-lp151.2.6.1",
"provider_source": "pypi",
"provider_record_id": "OPENSUSE-SU-2020:2106-1",
"provider_updated_at": "2026-02-04T04:04:49.802167Z",
"applicability_unknown": true
},
{
"name": "buildah",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.17.0-3.6.1"
}
]
}
],
"release": "linux enterprise module for containers 15 sp1",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/SUSE-SU-2020:3423-1",
"fixed_version": "1.17.0-3.6.1",
"provider_source": "pypi",
"provider_record_id": "SUSE-SU-2020:3423-1",
"provider_updated_at": "2026-02-04T03:56:02.237927Z",
"applicability_unknown": true
},
{
"name": "buildah",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.17.0-3.6.1"
}
]
}
],
"release": "linux enterprise module for containers 15 sp2",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/SUSE-SU-2020:3423-1",
"fixed_version": "1.17.0-3.6.1",
"provider_source": "pypi",
"provider_record_id": "SUSE-SU-2020:3423-1",
"provider_updated_at": "2026-02-04T03:56:02.237927Z",
"applicability_unknown": true
},
{
"name": "podman",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.4-4.11.1"
}
]
}
],
"release": "linux enterprise module for containers 15 sp1",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2346-1",
"fixed_version": "1.4.4-4.11.1",
"provider_source": "pypi",
"provider_record_id": "SUSE-SU-2019:2346-1",
"provider_updated_at": "2026-02-04T03:43:17.422170Z",
"applicability_unknown": true
},
{
"name": "buildah",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.19.2-lp152.2.3.1"
}
]
}
],
"release": "leap 15.2",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2021:0310-1",
"fixed_version": "1.19.2-lp152.2.3.1",
"provider_source": "pypi",
"provider_record_id": "OPENSUSE-SU-2021:0310-1",
"provider_updated_at": "2026-02-04T03:39:44.110025Z",
"applicability_unknown": true
},
{
"name": "libcontainers-common",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "20210112-lp152.2.6.1"
}
]
}
],
"release": "leap 15.2",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2021:0310-1",
"fixed_version": "20210112-lp152.2.6.1",
"provider_source": "pypi",
"provider_record_id": "OPENSUSE-SU-2021:0310-1",
"provider_updated_at": "2026-02-04T03:39:44.110025Z",
"applicability_unknown": true
},
{
"name": "podman",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.1-lp152.4.9.1"
}
]
}
],
"release": "leap 15.2",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2021:0310-1",
"fixed_version": "2.2.1-lp152.4.9.1",
"provider_source": "pypi",
"provider_record_id": "OPENSUSE-SU-2021:0310-1",
"provider_updated_at": "2026-02-04T03:39:44.110025Z",
"applicability_unknown": true
},
{
"name": "buildah",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.1-3.3.1"
}
]
}
],
"release": "linux enterprise module for containers 15 sp1",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/SUSE-SU-2019:2341-1",
"fixed_version": "1.7.1-3.3.1",
"provider_source": "pypi",
"provider_record_id": "SUSE-SU-2019:2341-1",
"provider_updated_at": "2026-02-04T03:35:23.615350Z",
"applicability_unknown": true
},
{
"name": "podman",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.4.4-lp151.3.6.1"
}
]
}
],
"release": "leap 15.1",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:2143-1",
"fixed_version": "1.4.4-lp151.3.6.1",
"provider_source": "pypi",
"provider_record_id": "OPENSUSE-SU-2019:2143-1",
"provider_updated_at": "2026-02-04T03:28:24.711090Z",
"applicability_unknown": true
},
{
"name": "buildah",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.23.0-1.1"
}
]
}
],
"release": "tumbleweed",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:10666-1",
"fixed_version": "1.23.0-1.1",
"provider_source": "pypi",
"provider_record_id": "OPENSUSE-SU-2024:10666-1",
"provider_updated_at": "2026-02-04T03:16:18.190894Z",
"applicability_unknown": true
},
{
"name": "buildah",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.23.1-150300.8.3.1"
}
]
}
],
"release": "linux enterprise module for containers 15 sp3",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/SUSE-SU-2022:0770-1",
"fixed_version": "1.23.1-150300.8.3.1",
"provider_source": "pypi",
"provider_record_id": "SUSE-SU-2022:0770-1",
"provider_updated_at": "2026-02-04T03:15:43.934984Z",
"applicability_unknown": true
},
{
"name": "buildah",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.23.1-150300.8.3.1"
}
]
}
],
"release": "leap 15.3",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2022:0770-1",
"fixed_version": "1.23.1-150300.8.3.1",
"provider_source": "pypi",
"provider_record_id": "OPENSUSE-SU-2022:0770-1",
"provider_updated_at": "2026-02-04T03:03:39.107503Z",
"applicability_unknown": true
},
{
"name": "skopeo",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.32-lp151.2.3.1"
}
]
}
],
"release": "leap 15.1",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:2138-1",
"fixed_version": "0.1.32-lp151.2.3.1",
"provider_source": "pypi",
"provider_record_id": "OPENSUSE-SU-2019:2138-1",
"provider_updated_at": "2026-02-04T02:41:36.209146Z",
"applicability_unknown": true
},
{
"name": "skopeo",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.41-4.11.1"
}
]
}
],
"release": "linux enterprise module for server applications 15 sp1",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/SUSE-SU-2020:0712-1",
"fixed_version": "0.1.41-4.11.1",
"provider_source": "pypi",
"provider_record_id": "SUSE-SU-2020:0712-1",
"provider_updated_at": "2026-02-04T02:38:01.024864Z",
"applicability_unknown": true
},
{
"name": "skopeo",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.41-lp151.2.6.1"
}
]
}
],
"release": "leap 15.1",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2020:0377-1",
"fixed_version": "0.1.41-lp151.2.6.1",
"provider_source": "pypi",
"provider_record_id": "OPENSUSE-SU-2020:0377-1",
"provider_updated_at": "2026-02-04T02:34:15.776105Z",
"applicability_unknown": true
},
{
"name": "buildah",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.1-lp151.2.3.1"
}
]
}
],
"release": "leap 15.1",
"versions": [],
"ecosystem": "rpm",
"provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2019:2137-1",
"fixed_version": "1.7.1-lp151.2.3.1",
"provider_source": "pypi",
"provider_record_id": "OPENSUSE-SU-2019:2137-1",
"provider_updated_at": "2026-02-04T02:29:20.565822Z",
"applicability_unknown": true
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [golang-github-containers-image]Unknown
Details (4)
5.23.1-4· all · bookwormNot affected
dsa · golang-github-containers-image · debian · bookworm
5.23.1-4· all · bookwormNot affected
dsa · golang-github-containers-image · debian · bookworm
5.26.1-2~bpo12+1· all · bookworm-backportsNot affected
dsa · golang-github-containers-image · debian · bookworm
5.26.1-2~bpo12+1· all · bookworm-backportsNot affected
dsa · golang-github-containers-image · debian · bookworm
- [golang-github-containers-image-dev]Unknown
Source package: [golang-github-containers-image]
Details (4)
5.23.1-4· all · bookwormNot affected
dsa · golang-github-containers-image · debian · bookworm
5.23.1-4· all · bookwormNot affected
dsa · golang-github-containers-image · debian · bookworm
5.26.1-2~bpo12+1· all · bookworm-backportsNot affected
dsa · golang-github-containers-image · debian · bookworm
5.26.1-2~bpo12+1· all · bookworm-backportsNot affected
dsa · golang-github-containers-image · debian · bookworm
[openSUSE Tumbleweed]
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2019_3403.json]
- [https://osv.dev/vulnerability/SUSE-SU-2019:2340-1]
- [https://osv.dev/vulnerability/SUSE-SU-2019:2341-1]
- [https://osv.dev/vulnerability/SUSE-SU-2019:2346-1]
- [https://osv.dev/vulnerability/SUSE-SU-2020:0712-1]
- [https://osv.dev/vulnerability/SUSE-SU-2020:3423-1]
- [https://osv.dev/vulnerability/SUSE-SU-2022:0770-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2019:2137-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2019:2138-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2019:2143-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2019:2159-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2020:0377-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2020:2106-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2021:0310-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2022:0770-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:10666-1]
- [https://security-tracker.debian.org/tracker/CVE-2019-10214]
- [https://security.access.redhat.com/data/csaf/v2/vex/2019/cve-2019-10214.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2019/wid-sec-w-2023-2983.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]