Critical severity9.1GHSA Advisory· Published Sep 17, 2024· Updated Apr 15, 2026
CVE-2024-7387
CVE-2024-7387
Description
A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build container can be overridden using the spec.source.secrets.secret.destinationDir attribute of the BuildConfig definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/openshift/builderGo | <= 4.0.0 | — |
Affected products
2Patches
Vulnerability mechanics
References
13- github.com/advisories/GHSA-qqv8-ph7f-h3f7ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-7387ghsaADVISORY
- access.redhat.com/errata/RHSA-2024:3718nvdWEB
- access.redhat.com/errata/RHSA-2024:6685nvdWEB
- access.redhat.com/errata/RHSA-2024:6687nvdWEB
- access.redhat.com/errata/RHSA-2024:6689nvdWEB
- access.redhat.com/errata/RHSA-2024:6691nvdWEB
- access.redhat.com/errata/RHSA-2024:6705nvdWEB
- access.redhat.com/security/cve/CVE-2024-7387nvdWEB
- bugzilla.redhat.com/show_bug.cginvdWEB
- github.com/openshift/builder/commit/0b62633adfa2836465202bc851885e078ec888d1nvdWEB
- pkg.go.dev/vuln/GO-2024-3129ghsaWEB
- stuxxn.github.io/advisory/2024/10/02/openshift-build-docker-priv-esc.htmlnvdWEB
News mentions
0No linked articles in our index yet.