Description

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process. Virtual machine images built using the Proxmox provider do not disable these default credentials, and nodes using the resulting images may be accessible via these default credentials. The credentials can be used to gain root access. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project with its Proxmox provider.

INFO

Published Date :

2024-10-15T20:33:43.138Z

Last Modified :

2024-10-16T18:56:40.632Z

Source :

kubernetes
AFFECTED PRODUCTS

The following products are affected by CVE-2024-9486 vulnerability.

Vendors Products
Kubernetes
  • Image Builder
Kubernetes-sigs
  • Image Builder
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-9486.

URL Resource
https://github.com/kubernetes-sigs/image-builder/pull/1595 cve-icon cve-icon
https://github.com/kubernetes/kubernetes/issues/128006 cve-icon cve-icon
https://groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-9486 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact