CVE-2019-19345: 
NixOS vulnerability analysis and mitigation

CVE-2019-19345 is a security vulnerability discovered in the openshift/mediawiki-apb container where incorrect privileges were assigned to the /etc/passwd file. The vulnerability was disclosed in January 2020 and affected Red Hat OpenShift Container Platform versions 3.11, 4.1, and 4.2 (Red Hat Advisory).

The vulnerability involves incorrect modification of permissions on the /etc/passwd file, making it modifiable by users other than root within the container. By default, this vulnerability is not exploitable in unprivileged containers running on OpenShift Container Platform, as the system calls SETUID and SETGID are blocked by the default seccomp policy (Bugzilla Report).

If exploited, an attacker with access to the running container could potentially modify the /etc/passwd file to add a user and escalate their privileges (Red Hat CVE).

Red Hat has addressed this vulnerability through several security updates: RHSA-2020:0617 for OpenShift Container Platform 4.2, RHSA-2020:0694 for OpenShift Container Platform 4.1, and RHSA-2020:0798 for OpenShift Container Platform 3.11. Users are advised to upgrade their clusters to apply these security fixes (Red Hat Advisory).