Red Hat修補OpenShift重大層級漏洞
支付動態 · 2024-09-19
本週Red Hat發布容器應用平臺OpenShift的更新版本，其中包含2項重大層級的漏洞CVE-2024-45496、CVE-2024-7387
Red Hat今天針對容器應用平臺OpenShift發布4.13.50版更新，修補2項重大層級漏洞CVE-2024-45496、CVE-2024-7387，這些漏洞有可能讓攻擊者執行任意命令，或是提升權限，CVSS風險評分為9.9、9.1。
回顧OpenShift今年的漏洞揭露與修補，上次嚴重性較高的漏洞是被評為8.0分的CVE-2024-6508，最新揭露的CVE-2024-45496，竟高達9.9分，令人訝異，此弱點的問題出在OpenShift的組建流程，在平臺組建初始化的步驟裡，名為git-clone的容器會以特殊權限啟動，而能夠無限制地存取節點。攻擊者可在取得開發者層級的權限下，在複製流程帶入特製的.gitconfig檔案，從而在運作的節點上執行任意命令。除此之外，攻擊者若是在具有特殊權限的容器當中的節點觸發漏洞，還能藉此得到容器具備的權限。
另一項漏洞CVE-2024-7387，則是出現在openshift/builder元件裡，攻擊者有機會藉由路徑穿越進行命令注入攻擊，而能在執行建構容器的OpenShift節點執行任意命令。這項漏洞發生在BuildConfig組態的特定屬性，使得攻擊者有機會覆寫特權容器裡的執行檔，而能在執行容器的節點上執行任意命令。
Popular articles
That’s a Wrap: AffPapa Conference Madrid 2026 Highlights
Online Game
B2B Tech Infrastructure Gains Momentum in Philippine Gaming Sector
Southeast Asia
Vietnam’s Controlled Gaming Shift Gains Ground, But Domestic Demand Still Lags
Southeast Asia
Gaming & Technology Expo Makes a Powerful Entrance in CDMX
Marketing
Vietnam's tightening online gaming policy creates new market opportunities
Southeast Asia
PropellerAds Shared a New iGaming Case Study: 97,674 Installs and 12,701 Deposits in 3 Months
Marketing
Zenith partners with HUIDU for 2026 World Cup Carnival Official Tour
Online Game
Kazakhstan plans to penalise online casino promotions
Regulation
1spin4win grows its Latin American presence by partnering with Fortuna Juegos
Online Game
Institutional Academy that exceeded expectations marked the opening of GAT CDMX
Online Game
Full House at GAT Expo Cartagena 2026 Academic Agenda
Online Game
PropellerAds Positions Itself as a Go-To Traffic Source for iGaming Advertisers Ahead of a High-Demand Season
Marketing
JILI Partners with Cricket Legend AB de Villiers (ABD) to Launch Exclusive Branded Game Series 100% 11
Sports Game
Brazil Proposes Raising Gambling Tax Rate to 24%, With Revenue Allocated to Social Security and Healthcare
Regulation
New Jersey July Gambling Revenue Hits $606M, Sweeps Casinos Banned
Regulation
