9.1

CVE-2024-7387

A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
Collection URLhttps://github.com/openshift/builder
≫
Package openshift/builder
Default Statusunaffected
Version < 0b62633adfa2836465202bc851885e078ec888d1
Version 0
Status affected
VendorRed Hat
≫
Product Red Hat OpenShift Container Platform 4.12
Default Statusaffected
Version < *
Version v4.12.0-202409121032.p1.g609473f.assembly.stream.el8
Status unaffected
VendorRed Hat
≫
Product Red Hat OpenShift Container Platform 4.13
Default Statusaffected
Version < *
Version v4.13.0-202409120505.p1.g2c7e99d.assembly.stream.el8
Status unaffected
VendorRed Hat
≫
Product Red Hat OpenShift Container Platform 4.14
Default Statusaffected
Version < *
Version v4.14.0-202409111409.p1.g52565ca.assembly.stream.el8
Status unaffected
VendorRed Hat
≫
Product Red Hat OpenShift Container Platform 4.15
Default Statusaffected
Version < *
Version v4.15.0-202409101936.p1.ge7749a3.assembly.stream.el8
Status unaffected
VendorRed Hat
≫
Product Red Hat OpenShift Container Platform 4.16
Default Statusaffected
Version < *
Version v4.16.0-202409101737.p1.gfee4b58.assembly.stream.el9
Status unaffected
VendorRed Hat
≫
Product Red Hat OpenShift Container Platform 4.17
Default Statusaffected
Version < *
Version v4.17.0-202409122005.p1.gcfcf3bd.assembly.stream.el9
Status unaffected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.92% 0.752
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
secalert@redhat.com 9.1 2.3 6
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-250 Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.