Skip to content
OpenAdvisories
Medium · 6.3 CVE-2024-9594 EUVD-2024-2994GHSA-8jpg-62jc-hwhrGO-2024-3204

VM images built with Image Builder with some providers use default credentials during builds

Published Oct 15, 2024 · Updated Oct 16, 2024 · Assigned by kubernetes

Description

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring.

Affected products

VendorProductAffectedFixed
Kubernetes Image Builder ≤ 0.1.37 0.1.38

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
SLES 15 SP6 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
SLES 15 SP5 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SUSE Package Hub 12 govulncheck-vulndb 0.0.20241104T154416-5.1 openSUSE-SU-2024:0350-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20241030T212825-1.1 openSUSE-SU-2024:14447-1
openSUSE Leap 15.6 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1
openSUSE Leap 15.5 govulncheck-vulndb 0.0.20241030T212825-150000.1.9.1 SUSE-SU-2024:3911-1

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/kubernetes-sigs/image-builder < 0.1.38 0.1.38 GHSA-8jpg-62jc-hwhr

Advisories 4

References