Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2024-7387GO-2024-3129GHSA-QQV8-PH7F-H3F7

Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategy

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: poc
  • Automatable: no
  • Technical impact: total

Summary

A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: poc · Automatable: no · Technical impact: total

  3. Record last updated

Affected versions

  • openshift/builder

    Version range not reported

  • openshift4/ose-docker-builder

    Version range not reported

  • openshift4/ose-docker-builder

    Version range not reported

  • openshift4/ose-docker-builder

    Version range not reported

  • openshift4/ose-docker-builder

    Version range not reported

  • openshift4/ose-docker-builder-rhel9

    Version range not reported

  • openshift4/ose-docker-builder-rhel9

    Version range not reported

  • openshift4/aws-kms-encryption-provider-rhel9

    Version range not reported

  • openshift4/azure-kms-encryption-provider-rhel9

    Version range not reported

  • openshift4/azure-service-rhel9-operator

    Version range not reported

  • openshift4/cloud-network-config-controller-rhel9

    Version range not reported

  • openshift4/container-networking-plugins-microshift-rhel9

    Version range not reported

  • openshift4/driver-toolkit-rhel9

    Version range not reported

  • openshift4/egress-router-cni-rhel9

    Version range not reported

  • openshift4/frr-rhel9

    Version range not reported

  • openshift4/insights-runtime-exporter-rhel9

    Version range not reported

  • openshift4/insights-runtime-extractor-rhel9

    Version range not reported

  • openshift4/kube-metrics-server-rhel9

    Version range not reported

  • openshift4/kubevirt-csi-driver-rhel9

    Version range not reported

  • openshift4/network-tools-rhel9

    Version range not reported

  • openshift4/oc-mirror-plugin-rhel9

    Version range not reported

  • openshift4/openshift-route-controller-manager-rhel9

    Version range not reported

  • openshift4/ose-agent-installer-api-server-rhel9

    Version range not reported

  • openshift4/ose-agent-installer-csr-approver-rhel9

    Version range not reported

  • openshift4/ose-agent-installer-node-agent-rhel9

    Version range not reported

  • openshift4/ose-agent-installer-orchestrator-rhel9

    Version range not reported

  • openshift4/ose-agent-installer-utils-rhel9

    Version range not reported

  • openshift4/ose-apiserver-network-proxy-rhel9

    Version range not reported

  • openshift4/ose-aws-cloud-controller-manager-rhel9

    Version range not reported

  • openshift4/ose-aws-cluster-api-controllers-rhel9

    Version range not reported

  • openshift4/ose-aws-ebs-csi-driver-rhel9

    Version range not reported

  • openshift4/ose-aws-ebs-csi-driver-rhel9-operator

    Version range not reported

  • openshift4/ose-aws-pod-identity-webhook-rhel9

    Version range not reported

  • openshift4/ose-azure-cloud-controller-manager-rhel9

    Version range not reported

  • openshift4/ose-azure-cloud-node-manager-rhel9

    Version range not reported

  • openshift4/ose-azure-cluster-api-controllers-rhel9

    Version range not reported

  • openshift4/ose-azure-disk-csi-driver-rhel9

    Version range not reported

  • openshift4/ose-azure-disk-csi-driver-rhel9-operator

    Version range not reported

  • openshift4/ose-azure-file-csi-driver-operator-rhel9

    Version range not reported

  • openshift4/ose-azure-file-csi-driver-rhel9

    Version range not reported

  • openshift4/ose-azure-workload-identity-webhook-rhel9

    Version range not reported

  • openshift4/ose-baremetal-cluster-api-controllers-rhel9

    Version range not reported

  • openshift4/ose-baremetal-installer-rhel9

    Version range not reported

  • openshift4/ose-baremetal-machine-controllers-rhel9

    Version range not reported

  • openshift4/ose-baremetal-rhel9-operator

    Version range not reported

  • openshift4/ose-baremetal-runtimecfg-rhel9

    Version range not reported

  • openshift4/ose-cli-artifacts-rhel9

    Version range not reported

  • openshift4/ose-cli-rhel9

    Version range not reported

  • openshift4/ose-cloud-credential-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-api-rhel9

    Version range not reported

  • openshift4/ose-cluster-authentication-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-autoscaler-rhel9

    Version range not reported

  • openshift4/ose-cluster-autoscaler-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-baremetal-operator-rhel9

    Version range not reported

  • openshift4/ose-cluster-bootstrap-rhel9

    Version range not reported

  • openshift4/ose-cluster-capi-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-cloud-controller-manager-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-config-api-rhel9

    Version range not reported

  • openshift4/ose-cluster-config-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-control-plane-machine-set-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-csi-snapshot-controller-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-dns-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-etcd-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-image-registry-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-ingress-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-kube-apiserver-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-kube-cluster-api-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-kube-controller-manager-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-kube-scheduler-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-kube-storage-version-migrator-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-machine-approver-rhel9

    Version range not reported

  • openshift4/ose-cluster-monitoring-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-network-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-node-tuning-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-olm-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-openshift-apiserver-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-openshift-controller-manager-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-policy-controller-rhel9

    Version range not reported

  • openshift4/ose-cluster-samples-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-storage-rhel9-operator

    Version range not reported

  • openshift4/ose-cluster-update-keys-rhel9

    Version range not reported

  • openshift4/ose-cluster-version-rhel9-operator

    Version range not reported

  • openshift4/ose-configmap-reloader-rhel9

    Version range not reported

  • openshift4/ose-console-rhel9

    Version range not reported

  • openshift4/ose-console-rhel9-operator

    Version range not reported

  • openshift4/ose-container-networking-plugins-rhel9

    Version range not reported

  • openshift4/ose-coredns-rhel9

    Version range not reported

  • openshift4/ose-csi-driver-manila-rhel9

    Version range not reported

  • openshift4/ose-csi-driver-manila-rhel9-operator

    Version range not reported

  • openshift4/ose-csi-driver-nfs-rhel9

    Version range not reported

  • openshift4/ose-csi-external-attacher-rhel9

    Version range not reported

  • openshift4/ose-csi-external-provisioner-rhel9

    Version range not reported

  • openshift4/ose-csi-external-resizer-rhel9

    Version range not reported

  • openshift4/ose-csi-external-snapshotter-rhel9

    Version range not reported

  • openshift4/ose-csi-livenessprobe-rhel9

    Version range not reported

  • openshift4/ose-csi-node-driver-registrar-rhel9

    Version range not reported

  • openshift4/ose-csi-snapshot-controller-rhel9

    Version range not reported

  • openshift4/ose-csi-snapshot-validation-webhook-rhel9

    Version range not reported

  • openshift4/ose-deployer-rhel9

    Version range not reported

  • openshift4/ose-docker-builder-rhel9

    Version range not reported

  • openshift4/ose-docker-registry-rhel9

    Version range not reported

  • openshift4/ose-etcd-rhel9

    Version range not reported

  • openshift4/ose-gcp-cloud-controller-manager-rhel9

    Version range not reported

  • openshift4/ose-gcp-cluster-api-controllers-rhel9

    Version range not reported

  • openshift4/ose-gcp-pd-csi-driver-operator-rhel9

    Version range not reported

  • openshift4/ose-gcp-pd-csi-driver-rhel9

    Version range not reported

  • openshift4/ose-gcp-workload-identity-federation-webhook-rhel9

    Version range not reported

  • openshift4/ose-haproxy-router-rhel9

    Version range not reported

  • openshift4/ose-hyperkube-rhel9

    Version range not reported

  • openshift4/ose-hypershift-rhel9

    Version range not reported

  • openshift4/ose-ibmcloud-cluster-api-controllers-rhel9

    Version range not reported

  • openshift4/ose-ibm-cloud-controller-manager-rhel9

    Version range not reported

  • openshift4/ose-ibmcloud-machine-controllers-rhel9

    Version range not reported

  • openshift4/ose-ibm-vpc-block-csi-driver-rhel9

    Version range not reported

  • openshift4/ose-ibm-vpc-block-csi-driver-rhel9-operator

    Version range not reported

  • openshift4/ose-image-customization-controller-rhel9

    Version range not reported

  • openshift4/ose-insights-rhel9-operator

    Version range not reported

  • openshift4/ose-installer-altinfra-rhel9

    Version range not reported

  • openshift4/ose-installer-artifacts-rhel9

    Version range not reported

  • openshift4/ose-installer-rhel9

    Version range not reported

  • openshift4/ose-ironic-agent-rhel9

    Version range not reported

  • openshift4/ose-ironic-machine-os-downloader-rhel9

    Version range not reported

  • openshift4/ose-ironic-rhel9

    Version range not reported

  • openshift4/ose-ironic-static-ip-manager-rhel9

    Version range not reported

  • openshift4/ose-keepalived-ipfailover-rhel9

    Version range not reported

  • openshift4/ose-kube-proxy-rhel9

    Version range not reported

  • openshift4/ose-kube-rbac-proxy-rhel9

    Version range not reported

  • openshift4/ose-kube-state-metrics-rhel9

    Version range not reported

  • openshift4/ose-kube-storage-version-migrator-rhel9

    Version range not reported

  • openshift4/ose-kubevirt-cloud-controller-manager-rhel9

    Version range not reported

  • openshift4/ose-libvirt-machine-controllers-rhel9

    Version range not reported

  • openshift4/ose-machine-api-provider-aws-rhel9

    Version range not reported

  • openshift4/ose-machine-api-provider-azure-rhel9

    Version range not reported

  • openshift4/ose-machine-api-provider-gcp-rhel9

    Version range not reported

  • openshift4/ose-machine-api-provider-openstack-rhel9

    Version range not reported

  • openshift4/ose-machine-api-rhel9-operator

    Version range not reported

  • openshift4/ose-machine-config-rhel9-operator

    Version range not reported

  • openshift4/ose-machine-os-images-rhel9

    Version range not reported

  • openshift4/ose-monitoring-plugin-rhel9

    Version range not reported

  • openshift4/ose-multus-admission-controller-rhel9

    Version range not reported

  • openshift4/ose-multus-cni-microshift-rhel9

    Version range not reported

  • openshift4/ose-multus-cni-rhel9

    Version range not reported

  • openshift4/ose-multus-networkpolicy-rhel9

    Version range not reported

  • openshift4/ose-multus-route-override-cni-rhel9

    Version range not reported

  • openshift4/ose-multus-whereabouts-ipam-cni-rhel9

    Version range not reported

  • openshift4/ose-must-gather-rhel9

    Version range not reported

  • openshift4/ose-networking-console-plugin-rhel9

    Version range not reported

  • openshift4/ose-network-interface-bond-cni-rhel9

    Version range not reported

  • openshift4/ose-network-metrics-daemon-rhel9

    Version range not reported

  • openshift4/ose-nutanix-cloud-controller-manager-rhel9

    Version range not reported

  • openshift4/ose-nutanix-machine-controllers-rhel9

    Version range not reported

  • openshift4/ose-oauth-apiserver-rhel9

    Version range not reported

  • openshift4/ose-oauth-proxy-rhel9

    Version range not reported

  • openshift4/ose-oauth-server-rhel9

    Version range not reported

  • openshift4/ose-olm-catalogd-rhel9

    Version range not reported

  • openshift4/ose-olm-operator-controller-rhel9

    Version range not reported

  • openshift4/ose-openshift-apiserver-rhel9

    Version range not reported

  • openshift4/ose-openshift-controller-manager-rhel9

    Version range not reported

  • openshift4/ose-openshift-state-metrics-rhel9

    Version range not reported

  • openshift4/ose-openstack-cinder-csi-driver-rhel9

    Version range not reported

  • openshift4/ose-openstack-cinder-csi-driver-rhel9-operator

    Version range not reported

  • openshift4/ose-openstack-cloud-controller-manager-rhel9

    Version range not reported

  • openshift4/ose-openstack-cluster-api-controllers-rhel9

    Version range not reported

  • openshift4/ose-operator-framework-tools-rhel9

    Version range not reported

  • openshift4/ose-operator-lifecycle-manager-rhel9

    Version range not reported

  • openshift4/ose-operator-marketplace-rhel9

    Version range not reported

  • openshift4/ose-operator-registry-rhel9

    Version range not reported

  • openshift4/ose-ovn-kubernetes-microshift-rhel9

    Version range not reported

  • openshift4/ose-ovn-kubernetes-rhel9

    Version range not reported

  • openshift4/ose-pod-rhel9

    Version range not reported

  • openshift4/ose-powervs-block-csi-driver-rhel9

    Version range not reported

  • openshift4/ose-powervs-block-csi-driver-rhel9-operator

    Version range not reported

  • openshift4/ose-powervs-cloud-controller-manager-rhel9

    Version range not reported

  • openshift4/ose-powervs-machine-controllers-rhel9

    Version range not reported

  • openshift4/ose-prometheus-alertmanager-rhel9

    Version range not reported

  • openshift4/ose-prometheus-config-reloader-rhel9

    Version range not reported

  • openshift4/ose-prometheus-node-exporter-rhel9

    Version range not reported

  • openshift4/ose-prometheus-operator-admission-webhook-rhel9

    Version range not reported

  • openshift4/ose-prometheus-rhel9

    Version range not reported

  • openshift4/ose-prometheus-rhel9-operator

    Version range not reported

  • openshift4/ose-prom-label-proxy-rhel9

    Version range not reported

  • openshift4/ose-service-ca-rhel9-operator

    Version range not reported

  • openshift4/ose-telemeter-rhel9

    Version range not reported

  • openshift4/ose-tests-rhel9

    Version range not reported

  • openshift4/ose-thanos-rhel9

    Version range not reported

  • openshift4/ose-tools-rhel9

    Version range not reported

  • openshift4/ose-vmware-vsphere-csi-driver-rhel9

    Version range not reported

  • openshift4/ose-vmware-vsphere-csi-driver-rhel9-operator

    Version range not reported

  • openshift4/ose-vsphere-cloud-controller-manager-rhel9

    Version range not reported

  • openshift4/ose-vsphere-cluster-api-controllers-rhel9

    Version range not reported

  • openshift4/ose-vsphere-csi-driver-rhel9

    Version range not reported

  • openshift4/ose-vsphere-csi-driver-rhel9-operator

    Version range not reported

  • openshift4/ose-vsphere-csi-driver-syncer-rhel9

    Version range not reported

  • openshift4/ose-vsphere-problem-detector-rhel9

    Version range not reported

  • openshift4/ovirt-csi-driver-rhel9

    Version range not reported

  • openshift4/ovirt-csi-driver-rhel9-operator

    Version range not reported

  • rhcos

    Version range not reported

  • github.com/openshift/builderGo

    All versions

  • github.com/openshift/builderGo

    through 4.0.0

References 11

access.redhat.com

bugzilla.redhat.com

GitHub · openshift/builder

stuxxn.github.io