~ / search / GHSA-77c2-c35q-254w

GHSA-77c2-c35q-254w

OpenShift Must Gather Operator Improper Input Validation vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-25131

Packages

EcosystemPackageAffectedFixed in
Go github.com/openshift/must-gather < 0.0.0-20240604173837-d1557bc283dd 0.0.0-20240604173837-d1557bc283dd

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. A non-privileged user on the cluster can create a MustGather object with a specially crafted file and set the most privileged service account to run the job. This can allow a standard developer user to escalate their privileges to a cluster administrator and pivot to the AWS environment.

References

External links from the advisory. They lead to third-party sites.