github - ghsa-9224-ggvw-wh7v

ghsa-9224-ggvw-wh7v

Vulnerability from github

Published

2024-10-15 21:30

Modified

2024-11-08 22:16

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder

Details

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kubernetes-sigs/image-builder"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.38"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-9486"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-17T20:28:15Z",
    "nvd_published_at": "2024-10-15T21:15:11Z",
    "severity": "CRITICAL"
  },
  "details": "A security issue was discovered in the Kubernetes Image Builder versions \u003c= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.",
  "id": "GHSA-9224-ggvw-wh7v",
  "modified": "2024-11-08T22:16:35Z",
  "published": "2024-10-15T21:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9486"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes/kubernetes/issues/128006"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes-sigs/image-builder/pull/1595"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kubernetes-sigs/image-builder"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder"
}

cve-2024-9486

Vulnerability from cvelistv5

Published

2024-10-15 20:33

Modified

2024-10-16 18:56

Severity ?

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

▼	URL	Tags
	https://github.com/kubernetes/kubernetes/issues/128006	vendor-advisory, issue-tracking
	https://github.com/kubernetes-sigs/image-builder/pull/1595	patch
	https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ	mailing-list

Impacted products

Vendor

Product

Version

▼

Kubernetes

Image Builder

Version: 0 ≤ 0.1.37

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:kubernetes:image_builder:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "image_builder",
            "vendor": "kubernetes",
            "versions": [
              {
                "lessThan": "0.1.38",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9486",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T18:55:30.755505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-16T18:56:40.632Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Image Builder",
          "repo": "https://github.com/kubernetes-sigs/image-builder",
          "vendor": "Kubernetes",
          "versions": [
            {
              "lessThanOrEqual": "0.1.37",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.1.38"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Nicolai Rybnikar @rybnico from Rybnikar Enterprises GmbH."
        }
      ],
      "datePublic": "2024-10-14T15:25:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA security issue was discovered in the Kubernetes Image Builder versions \u0026lt;= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.\u003c/p\u003e"
            }
          ],
          "value": "A security issue was discovered in the Kubernetes Image Builder versions \u003c= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-395",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-395 Bypassing Electronic Locks and Access Controls"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "VM Images built via Proxmox provider"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798 Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T20:33:43.138Z",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "issue-tracking"
          ],
          "url": "https://github.com/kubernetes/kubernetes/issues/128006"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kubernetes-sigs/image-builder/pull/1595"
        },
        {
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRebuild any affected images using a fixed version of Image Builder. Re-deploy the fixed images to any affected VMs.\u003c/p\u003e"
            }
          ],
          "value": "Rebuild any affected images using a fixed version of Image Builder. Re-deploy the fixed images to any affected VMs."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "VM images built with Image Builder and Proxmox provider use default credentials",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePrior to upgrading, this vulnerability can be mitigated by disabling the builder account on affected VMs:\u003cbr\u003eusermod -L builder\u003c/p\u003e"
            }
          ],
          "value": "Prior to upgrading, this vulnerability can be mitigated by disabling the builder account on affected VMs:\nusermod -L builder"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2024-9486",
    "datePublished": "2024-10-15T20:33:43.138Z",
    "dateReserved": "2024-10-03T16:33:36.995Z",
    "dateUpdated": "2024-10-16T18:56:40.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted