CVE-2024-25131: OpenShift Must Gather Operator Improper Input Validation vulnerability
A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard developer user to escalate their privileges to a cluster administrator and pivot to the AWS environment.
References
- access.redhat.com/security/cve/CVE-2024-25131
- bugzilla.redhat.com/show_bug.cgi?id=2258856
- github.com/advisories/GHSA-77c2-c35q-254w
- github.com/openshift/must-gather-operator
- github.com/openshift/must-gather-operator/pull/135
- github.com/openshift/must-gather-operator/pull/138
- nvd.nist.gov/vuln/detail/CVE-2024-25131
Code Behaviors & Features
Detect and mitigate CVE-2024-25131 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →