Nixpkgs Security Tracker

Login with GitHub

Suggestion detail

Untriaged
Permalink CVE-2024-45497
7.6 HIGH
  • CVSS version: 3.1
  • Attack vector (AV): NETWORK
  • Attack complexity (AC): LOW
  • Privileges required (PR): LOW
  • User interaction (UI): NONE
  • Scope (S): UNCHANGED
  • Confidentiality impact (C): LOW
  • Integrity impact (I): LOW
  • Availability impact (A): HIGH
created 6 months, 1 week ago
Openshift-api: build process in openshift allows overwriting of node pull credentials

A flaw was found in the OpenShift build process, where the docker-build container is configured with a hostPath volume mount that maps the node's /var/lib/kubelet/config.json file into the build pod. This file contains sensitive credentials necessary for pulling images from private repositories. The mount is not read-only, which allows the attacker to overwrite it. By modifying the config.json file, the attacker can cause a denial of service by preventing the node from pulling new images and potentially exfiltrating sensitive secrets. This flaw impacts the availability of services dependent on image pulls and exposes sensitive information to unauthorized parties.

References

Affected products

openshift
  • ==4.16
openshift-controller-manager
openshift4/ose-openshift-apiserver-rhel7
openshift4/ose-openshift-apiserver-rhel8
openshift4/ose-openshift-apiserver-rhel9
openshift4/ose-openshift-controller-manager-rhel9
  • *
org.arquillian.cube/arquillian-cube-openshift-api
openshift4/ose-cluster-openshift-apiserver-operator
  • *
openshift4/ose-cluster-openshift-apiserver-rhel9-operator
  • *

Matching in nixpkgs

pkgs.openshift

Build, deploy, and manage your applications with Docker and Kubernetes

  • nixos-unstable -

Package maintainers