github - ghsa-9224-ggvw-wh7v

GHSA-9224-GGVW-WH7V

Vulnerability from github – Published: 2024-10-15 21:30 – Updated: 2024-11-08 22:16

Summary

VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder

Details

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.

Severity ?

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/kubernetes-sigs/image-builder"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.1.38"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-9486"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-798"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-10-17T20:28:15Z",
    "nvd_published_at": "2024-10-15T21:15:11Z",
    "severity": "CRITICAL"
  },
  "details": "A security issue was discovered in the Kubernetes Image Builder versions \u003c= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.",
  "id": "GHSA-9224-ggvw-wh7v",
  "modified": "2024-11-08T22:16:35Z",
  "published": "2024-10-15T21:30:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9486"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes/kubernetes/issues/128006"
    },
    {
      "type": "WEB",
      "url": "https://github.com/kubernetes-sigs/image-builder/pull/1595"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/kubernetes-sigs/image-builder"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "VM images built with Image Builder and Proxmox provider use default credentials in github.com/kubernetes-sigs/image-builder"
}

CVE-2024-9486 (GCVE-0-2024-9486)

Vulnerability from cvelistv5 – Published: 2024-10-15 20:33 – Updated: 2024-10-16 18:56

Summary

Severity ?

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-798 - Use of Hard-coded Credentials

Assigner

kubernetes

References

URL

Tags

	https://github.com/kubernetes/kubernetes/issues/128006	vendor-advisoryissue-tracking
	https://github.com/kubernetes-sigs/image-builder/…	patch
	https://groups.google.com/g/kubernetes-security-a…	mailing-list

Impacted products

	Vendor	Product	Version
	Kubernetes	Image Builder	Affected: 0 , ≤ 0.1.37 (semver) Unaffected: 0.1.38

Credits

Nicolai Rybnikar @rybnico from Rybnikar Enterprises GmbH.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:kubernetes:image_builder:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "image_builder",
            "vendor": "kubernetes",
            "versions": [
              {
                "lessThan": "0.1.38",
                "status": "affected",
                "version": "0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-9486",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-16T18:55:30.755505Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-16T18:56:40.632Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Image Builder",
          "repo": "https://github.com/kubernetes-sigs/image-builder",
          "vendor": "Kubernetes",
          "versions": [
            {
              "lessThanOrEqual": "0.1.37",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "0.1.38"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Nicolai Rybnikar @rybnico from Rybnikar Enterprises GmbH."
        }
      ],
      "datePublic": "2024-10-14T15:25:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA security issue was discovered in the Kubernetes Image Builder versions \u0026lt;= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.\u003c/p\u003e"
            }
          ],
          "value": "A security issue was discovered in the Kubernetes Image Builder versions \u003c= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-395",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-395 Bypassing Electronic Locks and Access Controls"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "VM Images built via Proxmox provider"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-798",
              "description": "CWE-798 Use of Hard-coded Credentials",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-15T20:33:43.138Z",
        "orgId": "a6081bf6-c852-4425-ad4f-a67919267565",
        "shortName": "kubernetes"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "issue-tracking"
          ],
          "url": "https://github.com/kubernetes/kubernetes/issues/128006"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/kubernetes-sigs/image-builder/pull/1595"
        },
        {
          "tags": [
            "mailing-list"
          ],
          "url": "https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRebuild any affected images using a fixed version of Image Builder. Re-deploy the fixed images to any affected VMs.\u003c/p\u003e"
            }
          ],
          "value": "Rebuild any affected images using a fixed version of Image Builder. Re-deploy the fixed images to any affected VMs."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "VM images built with Image Builder and Proxmox provider use default credentials",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePrior to upgrading, this vulnerability can be mitigated by disabling the builder account on affected VMs:\u003cbr\u003eusermod -L builder\u003c/p\u003e"
            }
          ],
          "value": "Prior to upgrading, this vulnerability can be mitigated by disabling the builder account on affected VMs:\nusermod -L builder"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a6081bf6-c852-4425-ad4f-a67919267565",
    "assignerShortName": "kubernetes",
    "cveId": "CVE-2024-9486",
    "datePublished": "2024-10-15T20:33:43.138Z",
    "dateReserved": "2024-10-03T16:33:36.995Z",
    "dateUpdated": "2024-10-16T18:56:40.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-9224-GGVW-WH7V

CVE-2024-9486 (GCVE-0-2024-9486)

Tags

Sightings

Nomenclature