CVE-2024-9594

Katalog CVE

CVSS 8.1 · High EPSS 1,7%

Kerentanan Use of Hard-coded Credentials pada kubernetes-sigs image builder. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring.

Rincian

Terbit di NVD

15 Oktober 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ advisory vendor
• https://github.com/kubernetes-sigs/image-builder/pull/1596 patch
• https://github.com/kubernetes/kubernetes/issues/128007 issue tracking