PT-2024-20772 · Red Hat+1 · Openshift Dedicated+1

Robb Gatica + 1 · Published 2024-12-31 · Updated 2025-01-10 · CVE-2024-25133

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenShift Dedicated (affected versions not specified)

Description A flaw was found in the Hive ClusterDeployments resource in OpenShift Dedicated. In certain conditions, this issue may allow a developer account on a Hive-enabled cluster to obtain cluster-admin privileges by executing arbitrary commands on the hive/hive-controllers pod.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-25133

GHSA-WGQQ-9QH8-WVQV

GO-2024-3360

OPENSUSE-SU-2025:14624-1

OPENSUSE-SU-2025_0060-1

SUSE-SU-2025:0060-1

Affected Products

Openshift Dedicated

Suse

References · 37

• https://osv.dev/vulnerability/CVE-2024-25133 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:0060-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25133 · Security Note
• https://osv.dev/vulnerability/GHSA-wgqq-9qh8-wvqv · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14624-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3360 · Vendor Advisory
• https://github.com/openshift/hive/pull/2306 · Note
• https://github.com/openshift/hive · Note
• https://github.com/openshift/hive/commit/5ba846620f9dbf49301dabb0d40cc980aabef4e0 · Note
• https://suse.com/security/cve/CVE-2024-12678 · Note
• https://twitter.com/bluepinksec/status/1874976811710288031 · Twitter Post
• https://suse.com/security/cve/CVE-2024-54148 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/UV63VQGB6Y3V7AIZHIKF3PMFVIHM32MI · Note
• https://suse.com/security/cve/CVE-2024-55196 · Note
• https://suse.com/security/cve/CVE-2024-55947 · Note