Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container

2024-06-2906:55:05

Google

osv.dev

kubevirt

virt-api

virt-controller

virt-exportproxy

virt-exportserver

virt-handler

virt-launcher

virt-libguestfs-tools

virt-operator

security update

cve-2024-33394

go releases

procps installation

component role rules

CVSS3

5.9

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

AI Score

6.8

Confidence

Low

JSON

This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues:

Collect component Role rules under operator Role instead of
ClusterRole (bsc#1223965, CVE-2024-33394)
Ensure procps is installed (provides ps for tests)

This update also rebuilds it against current go releases.