Vulnerability · Published Dec 31, 2024 · Assigned by redhat
CVE-2024-25133Openshift-dedicated: hive: rce through aws/kubernetes client configuration leads to privilege escalation
High 8.8
In plain English
A high-severity improper access control in openshift-hive. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 57.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enabled cluster to obtain cluster-admin privileges by executing arbitrary commands on the hive/hive-controllers pod.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/openshift/hive | no fix listed | GHSA-wgqq-9qh8-wvqv |
| Go | github.com/openshift/hive | no fix listed | GO-2024-3360 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| openshift-hive | 0 – before 5ba846620f9dbf49301dabb0d40cc980aabef4e0 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://access.redhat.com/security/cve/CVE-2024-25133 vdb-entry, x_refsource_REDHAT
- RHBZ#2260372 issue-tracking, x_refsource_REDHAT
- https://github.com/openshift/hive/pull/2306