Description
A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | openshift/builder | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.12 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.13 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.14 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.15 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.16 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.17 | — | — |
| Red Hat | Red Hat OpenShift Container Platform 4.18 | — | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/openshift/builder | <= 4.0.0 | — | GHSA-qqv8-ph7f-h3f7 |
| Go | github.com/openshift/builder | all versions | — | GO-2024-3129 |
Advisories 1
- WID-SEC-2024-2174 Red Hat OpenShift: Mehrere Schwachstellen ermöglichen Codeausführung BSI CERT-Bund (WID) · Sep 19, 2024
References
- RHSA-2024:3718 vendor-advisory
- RHSA-2024:6122 vendor-advisory
- RHSA-2024:6685 vendor-advisory
- RHSA-2024:6687 vendor-advisory
- RHSA-2024:6689 vendor-advisory
- RHSA-2024:6691 vendor-advisory
- RHSA-2024:6705 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-7387 vdb-entry
- RHBZ#2302259 issue-tracking
- https://github.com/openshift/builder/commit/0b62633adfa2836465202bc851885e078ec888d1
- https://stuxxn.github.io/advisory/2024/10/02/openshift-build-docker-priv-esc.html