2024-099: Critical Vulnerabilities in Openshift

2024-099: Critical Vulnerabilities in Openshift ↗ source

September 18, 2024 CERT-EU Advisory

Source: https://cert.europa.eu/publications/security-advisories/2024-099/

Summary

The vulnerability CVE-2024-45496 with a CVSS score of 9.9, arises from the misuse of elevated privileges during the build process [1]. The git-clone container runs with privileged access, allowing attackers with developer-level permission to exploit a crafted .gitconfig file. This enables arbitrary command execution on the worker node. An attacker in a privileged container could escalate permission on the node, gaining unauthorised control. The vulnerability CVE-2024-7387 with a CVSS score of 9.1, allows command injection via path traversal.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2024-45496	9.9 Critical	— A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During…
CVE-2024-7387	9.1 Critical	— A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary c…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Red Hat 9 KEV Docker 1 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.