This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Kubernetes Image Builder fixes two vulnerabilities
Kubernetes Image Builder v0.1.38 fixes two vulnerabilities, the first of which is rated critical [1]. The second, similar vulnerability [2] received a lower CVSS score because it is harder to exploit.
An unauthenticated remote attacker can gain root access on nodes using virtual machine images built with the Proxmox provider, because the default credentials enabled during the image creation process are not disabled [1][3].
The vulnerability is present in product:
- Kubernetes Image Builder; <=0.1.37
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2024-9486 at cve.org, NVD
- CWE-1392: Use of Default Credentials at cwe.mitre.org
The vulnerability was publicly disclosed 11. 10. 2024.
An authenticated attacker on the local network can gain root access on nodes using virtual machine images built with the Nutanix, OVA, QEMU or raw providers, because default credentials are enabled during the image build process. These credentials are disabled at the end of the image creation process [2][4].
The vulnerability is present in product:
- Kubernetes Image Builder; <=0.1.37
CVSS: CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2024-9594 at cve.org, NVD
- CWE-1392: Use of Default Credentials at cwe.mitre.org
The vulnerability was publicly disclosed 11. 10. 2024.
Links
- [1] https://github.com/kubernetes/kubernetes/issues/128006
- [2] https://github.com/kubernetes/kubernetes/issues/128007
- [3] https://github.com/kubernetes-sigs/image-builder/pull/1595/commits/f4fb7c1ae05bdb683b30bd47f6c8ab2c9f1dacb1
- [4] https://github.com/kubernetes-sigs/image-builder/pull/1596/commits/85ded65ae8dcbdcf922a1b43d8b0c0a838c7ad80
By CESNET, z.s.p.o. Michaela Jarošová on 15. 10. 2024.