CVE-2019-19348: 
NixOS vulnerability analysis and mitigation

An insecure modification vulnerability (CVE-2019-19348) was discovered in the container openshift/apb-base, affecting versions before 4.3.5. The vulnerability involves incorrect privileges being assigned to the /etc/passwd file (Red Hat CVE, Red Hat Advisory).

The vulnerability stems from the container modifying the permissions of /etc/passwd to make it modifiable by users other than root. This security issue was rated as having a Moderate severity impact by Red Hat Product Security (Red Hat Advisory).

An attacker with access to the running container could potentially exploit this vulnerability to modify /etc/passwd to add a user and escalate their privileges. However, by default, this vulnerability is not exploitable in unprivileged containers running on OpenShift Container Platform, as the system calls SETUID and SETGID are blocked by the default seccomp policy (Bugzilla).

The vulnerability has been addressed in multiple OpenShift Container Platform versions: 4.3.5, 4.2.21, 4.1.38, and 3.11.188-4. Users are advised to upgrade to these or later versions to resolve the security issue (Red Hat Advisory).