Loading...
Skip to main content
GeekWala

CVE-2024-7387 — Vulnerability in github.com/openshift/builder —...

MEDIUM

OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer

Published September 17, 2024Updated August 11, 2026Source: osv

Summary

A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the "Docker" strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.

Advisory Timeline

  • First published September 17, 2024 (755 days ago).
  • Last revised August 11, 2026 — 694 days after initial publication.

Affected Packages (1)

Affects 1 ecosystem: go (1).

PackageEcosystemAffectedFixed In
github.com/openshift/builder
go
All versionsRange-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.1 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-7387?
OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 9.1/10).
How do I check if my project is affected by CVE-2024-7387?
CVE-2024-7387 affects github.com/openshift/builder. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-7387 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.1

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-qqv8-ph7f-h3f7
GO-2024-3129

Related CVEs

  • CVE-2024-25131
    HIGH

    OpenShift Must Gather Operator Improper Input Validation vulnerability

  • CVE-2026-54167
    HIGH

    Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

  • CVE-2025-14443
    HIGH

    openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References

  • CVE-2024-25133
    HIGH

    OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation

  • CVE-2026-54765
    MEDIUM

    Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port

  • CVE-2024-45496
    MEDIUM

    OpenShift Controller Manager Improper Privilege Management

  • CVE-2026-88011
    MEDIUM

    Traefik: ForwardAuth identity spoofing via dot-form header alias

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies