Skip to content
OpenAdvisories
High WID-SEC-2024-3173 2 CVEs

Kubernetes: Mehrere Schwachstellen ermöglichen Privilegieneskalation

Published Oct 14, 2024 · Updated Oct 16, 2024 · Revision 2 · de-DE

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Kubernetes ausnutzen, um seine Privilegien zu erhöhen.

Product

Kubernetes ist ein Werkzeug zur Automatisierung der Bereitstellung, Skalierung und Verwaltung von containerisierten Anwendungen.

Vulnerabilities 2

  • Critical 9.8
    CVE-2024-9486

    VM images built with Image Builder and Proxmox provider use default credentials

    A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nod…

    Kubernetes Image Builder github.com/kubernetes-sigs/image-builder Go
  • Medium 6.3
    CVE-2024-9594

    VM images built with Image Builder with some providers use default credentials during builds

    A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The c…

    Kubernetes Image Builder github.com/kubernetes-sigs/image-builder Go

Revision history

  1. #2

    Neue Updates von Red Hat aufgenommen

  2. #1

    Initiale Fassung

References