CVE-2024-9594 VM images built with Image Builder with some providers use default credentials during builds

🗓️ 15 Oct 2024 20:37:01Reported by kubernetesType

CVE-2024-9594 Kubernetes Image Builder default credentials vulnerabilit

Reporter	Title	Published	Views	Family All 79
BDU FSTEC	The vulnerability of the Kubernetes Image Builder software lies in its use of hard-coded credentials, which allows an attacker to gain access to the virtual machine.	17 Oct 202400:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Kubernetes Image Builder software lies in its use of hard-coded credentials, which allows an attacker to gain access to the virtual machine.	18 Oct 202400:00	–	bdu_fstec
Circl	CVE-2024-9594	17 Oct 202414:28	–	circl
CNNVD	Image Builder 安全漏洞	15 Oct 202400:00	–	cnnvd
CVE	CVE-2024-9594	15 Oct 202420:37	–	cve
EUVD	EUVD-2024-2994	3 Oct 202520:07	–	euvd
Github Security Blog	VM images built with Image Builder with some providers use default credentials during builds in github.com/kubernetes-sigs/image-builder	15 Oct 202421:30	–	github
NVD	CVE-2024-9594	15 Oct 202421:15	–	nvd
OPENSUSE Linux	Security update for govulncheck-vulndb (important)	5 Nov 202400:00	–	opensuse
OPENSUSE Linux	govulncheck-vulndb-0.0.20241030T212825-1.1 on GA media (moderate)	2 Nov 202400:00	–	opensuse

[
  {
    "vendor": "Kubernetes",
    "product": "Image Builder",
    "repo": "https://github.com/kubernetes-sigs/image-builder",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThanOrEqual": "0.1.37",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "0.1.38"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
github	www.github.com/kubernetes-sigs/image-builder/pull/1596
groups	www.groups.google.com/g/kubernetes-security-announce/c/UKJG-oZogfA/m/Lu1hcnHmAQAJ
github	www.github.com/kubernetes/kubernetes/issues/128007

15 Oct 2024 20:37Current

CVSS 3.16.3

EPSS0.02648

CWE-798