Red Hat修補OpenShift重大層級漏洞
支付動態 · 2024-09-19
本週Red Hat發布容器應用平臺OpenShift的更新版本，其中包含2項重大層級的漏洞CVE-2024-45496、CVE-2024-7387
Red Hat今天針對容器應用平臺OpenShift發布4.13.50版更新，修補2項重大層級漏洞CVE-2024-45496、CVE-2024-7387，這些漏洞有可能讓攻擊者執行任意命令，或是提升權限，CVSS風險評分為9.9、9.1。
回顧OpenShift今年的漏洞揭露與修補，上次嚴重性較高的漏洞是被評為8.0分的CVE-2024-6508，最新揭露的CVE-2024-45496，竟高達9.9分，令人訝異，此弱點的問題出在OpenShift的組建流程，在平臺組建初始化的步驟裡，名為git-clone的容器會以特殊權限啟動，而能夠無限制地存取節點。攻擊者可在取得開發者層級的權限下，在複製流程帶入特製的.gitconfig檔案，從而在運作的節點上執行任意命令。除此之外，攻擊者若是在具有特殊權限的容器當中的節點觸發漏洞，還能藉此得到容器具備的權限。
另一項漏洞CVE-2024-7387，則是出現在openshift/builder元件裡，攻擊者有機會藉由路徑穿越進行命令注入攻擊，而能在執行建構容器的OpenShift節點執行任意命令。這項漏洞發生在BuildConfig組態的特定屬性，使得攻擊者有機會覆寫特權容器裡的執行檔，而能在執行容器的節點上執行任意命令。
Popular articles
British gambling levy rates confirmed for each vertical
Regulation
PropellerAds Shared a New iGaming Case Study: 97,674 Installs and 12,701 Deposits in 3 Months
Marketing
Vietnam’s Controlled Gaming Shift Gains Ground, But Domestic Demand Still Lags
Southeast Asia
GAT CDMX 2025 Institutional Academy: Leaders and Experts Analyze the Present and Future of the Gaming Industry in Mexico and Lat
Sports Game
Institutional Academy that exceeded expectations marked the opening of GAT CDMX
Online Game
GGC Awards 2026 Shines in Colombo: Honoring Leaders and Innovators in the iGaming Industry
HUIDU Focus
UK MPs reopen 2025 gambling inquiry as reform stalls
Regulation
Brazil Proposes Raising Gambling Tax Rate to 24%, With Revenue Allocated to Social Security and Healthcare
Regulation
New Jersey July Gambling Revenue Hits $606M, Sweeps Casinos Banned
Regulation
Gaming & Technology Expo Makes a Powerful Entrance in CDMX
Marketing
1spin4win releases unique slot Don Catleone Hold and Win featuring gangster cats
Online Game
GAT Expo Puerto Rico Will Pulse with the New Era of Gaming in the Caribbean
Marketing
Are you ready to maximize your earnings? Try ProPush.me Constructor!
Marketing
Across 6 Cities: HUIDU Invites You to 8 World Cup Parties Redefining High-Value Social Networking
HUIDU Focus
SBC Summit Canada to Make Player Safety a Key Pillar of 2026 Agenda
Marketing
