Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Codeausführung

Summary

Product

Vulnerabilities 2

• Critical 9.9
  CVE-2024-45496

  Openshift-controller-manager: elevated build pods can lead to node compromise in openshift

  A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build initialization step, the git-clone container is run with a privileged security context, allowing un…

  Red Hat Red Hat OpenShift Container Platform 4.14 Red Hat OpenShift Container Platform 4.18 Red Hat OpenShift Container Platform 4.16 Go
  Sep 16, 2024
• Critical 9.1
  CVE-2024-7387

  Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategy

  A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable file…

  Red Hat Red Hat OpenShift Container Platform 4.14 Red Hat OpenShift Container Platform 4.16 Red Hat OpenShift Container Platform 4.18 Go
  Sep 16, 2024

Revision history

1. 2024-09-19 #3

   Neue Updates von Red Hat aufgenommen

2. 2024-09-18 #2

   Neue Updates von Red Hat aufgenommen

3. 2024-09-17 #1

   Initiale Fassung

References

• GitHub Advisory Database vom 2024-09-17
  https://github.com/advisories/GHSA-j8gh-87rx-c7w9
• GitHub Advisory Database vom 2024-09-17
  https://github.com/advisories/GHSA-qqv8-ph7f-h3f7
• RedHat Customer Portal vom 2024-09-17
  https://access.redhat.com/security/cve/CVE-2024-45496
• RedHat Customer Portal vom 2024-09-17
  https://access.redhat.com/security/cve/CVE-2024-7387
• Red Hat Security Advisory RHSA-2024:6689 vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6689
• Red Hat Security Advisory RHSA-2024:6691 vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6691
• Red Hat Security Advisory RHSA-2024:6687 vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6687
• Red Hat Security Advisory RHSA-2024:6685 vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6685
• Red Hat Security Advisory RHSA-2024:6705 vom 2024-09-19
  https://access.redhat.com/errata/RHSA-2024:6705