What’s Vulnerable › Vulnerabilities

CVE-2024-7387: Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategy

• Severity: critical (CVSS 9.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-09-17 · updated 2026-08-11
• Weakness: CWE-250

Description

A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.

Affected products

• Red Hat OpenShift Container Platform 4.18: all versions — fixed in 418.94.202502100215-0, v4.18.0-202412170221.p0.ga26fffe.assembly.stream.el9, v4.18.0-202412170221.p0.gcfbae04.assembly.stream.el9, v4.18.0-202412200107.p0.g2957f13.assembly.stream.el9, v4.18.0-202501201133.p0.g4674e81.assembly.stream.el9, v4.18.0-202501230001.p0.g00882ba.assembly.stream.el9
• Red Hat OpenShift Container Platform 4.12: all versions — fixed in v4.12.0-202409121032.p1.g609473f.assembly.stream.el8
• Red Hat OpenShift Container Platform 4.13: all versions — fixed in v4.13.0-202409120505.p1.g2c7e99d.assembly.stream.el8
• Red Hat OpenShift Container Platform 4.14: all versions — fixed in v4.14.0-202409111409.p1.g52565ca.assembly.stream.el8
• Red Hat OpenShift Container Platform 4.15: all versions — fixed in v4.15.0-202409101936.p1.ge7749a3.assembly.stream.el8
• Red Hat OpenShift Container Platform 4.16: all versions — fixed in v4.16.0-202409101737.p1.gfee4b58.assembly.stream.el9
• Red Hat OpenShift Container Platform 4.17: all versions — fixed in v4.17.0-202409122005.p1.gcfcf3bd.assembly.stream.el9

How to fix

Upgrade to a fixed version: Red Hat OpenShift Container Platform 4.18 418.94.202502100215-0, v4.18.0-202412170221.p0.ga26fffe.assembly.stream.el9, v4.18.0-202412170221.p0.gcfbae04.assembly.stream.el9, v4.18.0-202412200107.p0.g2957f13.assembly.stream.el9; Red Hat OpenShift Container Platform 4.12 v4.12.0-202409121032.p1.g609473f.assembly.stream.el8; Red Hat OpenShift Container Platform 4.13 v4.13.0-202409120505.p1.g2c7e99d.assembly.stream.el8; Red Hat OpenShift Container Platform 4.14 v4.14.0-202409111409.p1.g52565ca.assembly.stream.el8; Red Hat OpenShift Container Platform 4.15 v4.15.0-202409101936.p1.ge7749a3.assembly.stream.el8; Red Hat OpenShift Container Platform 4.16 v4.16.0-202409101737.p1.gfee4b58.assembly.stream.el9; Red Hat OpenShift Container Platform 4.17 v4.17.0-202409122005.p1.gcfcf3bd.assembly.stream.el9. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2024:3718
• https://access.redhat.com/errata/RHSA-2024:6122
• https://access.redhat.com/errata/RHSA-2024:6685
• https://access.redhat.com/errata/RHSA-2024:6687
• https://access.redhat.com/errata/RHSA-2024:6689
• https://access.redhat.com/errata/RHSA-2024:6691
• https://access.redhat.com/errata/RHSA-2024:6705
• https://access.redhat.com/security/cve/CVE-2024-7387
• https://bugzilla.redhat.com/show_bug.cgi?id=2302259
• https://github.com/openshift/builder/commit/0b62633adfa2836465202bc851885e078ec888d1
• https://stuxxn.github.io/advisory/2024/10/02/openshift-build-docker-priv-esc.html

Get alerted when CVE-2024-7387 or the next vulnerability affects your stack