GHSA-qqv8-ph7f-h3f7

Source

https://github.com/advisories/GHSA-qqv8-ph7f-h3f7

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-qqv8-ph7f-h3f7

Aliases

CVE-2024-7387
GO-2024-3129

Published

2024-09-17T00:31:06Z

Modified

2024-11-18T16:27:13Z

Severity

9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
6.4 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H CVSS Calculator

Summary

OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer

Details

A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the "Docker" strategy, executable files inside the privileged build container can be overridden using the spec.source.secrets.secret.destinationDir attribute of the BuildConfig definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.

Database specific

{
    "nvd_published_at": "2024-09-17T00:15:52Z",
    "cwe_ids": [
        "CWE-250"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2024-09-17T18:31:41Z"
}

References

Affected packages

Go / github.com/openshift/builder

Package

Name: github.com/openshift/builder; View open source insights on deps.dev
Purl: pkg:golang/github.com/openshift/builder

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

4.0.0