SB2024101727 - Multiple vulnerabilities in Kubernetes Image Builder

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2024101727

SB2024101727 - Multiple vulnerabilities in Kubernetes Image Builder

Published: October 17, 2024

Security Bulletin ID SB2024101727
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Use of default credentials (CVE-ID: CVE-2024-9486)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to default credentials are enabled during the image build process when building with Proxmox provider. A remote attacker can gain root access to the affected virtual machines.


2) Use of default credentials (CVE-ID: CVE-2024-9594)

The vulnerability allows a remote attacker to compromise the image build process.

The vulnerability exists due to default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. A remote attacker with ability to reach the VM where the image build was happening can compromise the image during its build.


Remediation

Install update from vendor's website.

References