Loading...
Skip to main content
GeekWala

CVE-2024-45496 — Vulnerability in...

MEDIUM

OpenShift Controller Manager Improper Privilege Management

Published September 17, 2024Updated January 9, 2025Source: osv

Summary

A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build initialization step, the git-clone container is run with a privileged security context, allowing unrestricted access to the node. An attacker with developer-level access can provide a crafted .gitconfig file containing commands executed during the cloning process, leading to arbitrary command execution on the worker node. An attacker running code in a privileged container could escalate their permissions on the node running the container.

Advisory Timeline

  • First published September 17, 2024 (755 days ago).
  • Last revised January 9, 2025 — 114 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Go
Update github.com/openshift/openshift-controller-manager to 0.0.0-alpha.0.0.20240911 or later
go get github.com/openshift/openshift-controller-manager@v0.0.0-alpha.0.0.20240911

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/openshift/openshift-controller-manager
go
All versions0.0.0-alpha.0.0.20240911

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-269
    Improper Privilege ManagementMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

References

Frequently Asked Questions

What is CVE-2024-45496?
OpenShift Controller Manager Improper Privilege Management This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2024-45496?
CVE-2024-45496 affects github.com/openshift/openshift-controller-manager. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-45496 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-j8gh-87rx-c7w9
GO-2024-3128

Related CVEs

  • CVE-2024-25131
    HIGH

    OpenShift Must Gather Operator Improper Input Validation vulnerability

  • CVE-2026-54167
    HIGH

    Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

  • CVE-2025-14443
    HIGH

    openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References

  • CVE-2024-25133
    HIGH

    OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation

  • CVE-2026-54765
    MEDIUM

    Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

  • CVE-2024-7387
    MEDIUM

    OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer

  • CVE-2026-88011
    MEDIUM

    Traefik: ForwardAuth identity spoofing via dot-form header alias

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies