CVE-2020-1707: 
NixOS vulnerability analysis and mitigation

CVE-2020-1707 is a security vulnerability discovered in the openshift/postgresql-apb container where /etc/passwd was given incorrect privileges. The vulnerability was first reported on January 21, 2020, and affects multiple versions of Red Hat OpenShift Container Platform including versions 3.11, 4.1, 4.2, and 4.3 (Red Hat Advisory, Bugzilla).

The vulnerability occurs when the container modifies the permissions of /etc/passwd to make them modifiable by users other than root. By default, this vulnerability is not exploitable in unprivileged containers running on OpenShift Container Platform because the system calls SETUID and SETGID are blocked by the default seccomp policy (Bugzilla).

An attacker with access to the running container could potentially exploit this vulnerability to modify /etc/passwd to add a user and escalate their privileges (Bugzilla).

Red Hat has released security updates to address this vulnerability across multiple versions of OpenShift Container Platform. Updates were released through several security advisories: RHSA-2020:0617 for version 4.2, RHSA-2020:0681 for version 4.3, RHSA-2020:0694 for version 4.1, and RHSA-2020:0801 for version 3.11 (Red Hat Advisory).

The vulnerability was discovered and reported by Joseph LaMagna-Reiter from SPR Inc (Bugzilla).