PT-2021-20139 · Red Hat · Openshift Builder

Sam Fowler · Published 2021-03-16 · Updated 2021-08-03 · CVE-2021-3344

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions github.com/openshift/builder versions v0.0.0-20210125201112-7901cb396121 and before

Description A privilege escalation flaw was found in OpenShift builder, where credentials outside the build context are automatically mounted into the container image under construction during build time. This allows an OpenShift user who can execute code during build time inside the container to re-use the credentials and overwrite arbitrary container images in internal registries and/or escalate their privileges. The highest threat from this issue is to data confidentiality and integrity as well as system availability.

Recommendations For versions v0.0.0-20210125201112-7901cb396121 and before, consider restricting access to the build process to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the privileges of users who can execute code during build time to prevent potential escalation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2021-3344

Affected Products

Openshift Builder

References · 4

• https://osv.dev/vulnerability/CVE-2021-3344 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1921450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3344 · Security Note
• https://t.me/cibsecurity/24980 · Telegram Post