Log in Start free

Vulnerability · Published Dec 31, 2024 · Assigned by redhat

CVE-2024-45497Openshift-api: openshift-controller-manager/build: build process in openshift allows overwriting of node pull credentials

High 7.6

In plain English

A high-severity incorrect permission assignment in openshift. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities).

Severity (CVSS 3.1)7.6High
Exploit odds (30 days)0.6%top 52.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kubelet/config.json file into the build pod. This file contains sensitive credentials necessary for pulling images from private repositories. The mount is not read-only, which allows the attacker to overwrite it. By modifying the config.json file, the attacker can cause a denial of service by preventing the node from pulling new images and potentially exfiltrating sensitive secrets. This flaw impacts the availability of services dependent on image pulls and exposes sensitive information to unauthorized parties.

Affected products (as reported)

VendorProductVersions
openshift 4.16
Red Hat Red Hat OpenShift Container Platform 4.12 see references
Red Hat Red Hat OpenShift Container Platform 4.13 see references
Red Hat Red Hat OpenShift Container Platform 4.14 see references
Red Hat Red Hat OpenShift Container Platform 4.16 see references
Red Hat Red Hat OpenShift Container Platform 4.17 see references
Red Hat Red Hat OpenShift Container Platform 4.18 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references
Red Hat Red Hat OpenShift Container Platform 4.19 see references

Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

References