CyberzSOC

It is recommended updating the Kubernetes Image Builder, and redeploying or mitigating Virtual Machines (VMs) created by the vulnerable Kubernetes Image Builder. The flaw affects Kubernetes Image Builder version 0.1.37 and earlier. It enables root access via SSH using default credentials on VMs built with the vulnerable version of Kubernetes Image For images built with the Proxmox provider, the vulnerability has been assigned CVE-2024-9486 , For images built with the Nutanix, OVA, QEMU or raw providers, the vulnerability has been assigned CVE-2024-9594 , with a CVSS of 6.3. It is strongly recommended updating the Kubernetes Image Builder and redeploying VMs created by the vulnerable Kubernetes Image Builder. It is possible to mitigate the vulnerability in affected VMs by disabling the builder account: The Linux command last builder can be used to view logins to the affected builder account.