Developer Tools

In OpenShift versions using Buildah a medium severity vulnerability CVE-2024-9675 was detected. This vulnerability lets attackers choose paths outside the cache directory, allowing a `RUN` instruction in a Container file to mount any accessible directory from the host (with read/write permissions) into the container. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-9675.

In GitLab versions starting from 8.16 up to 17.2.8, versions 17.3 prior to 17.3.5, and versions 17.4 prior to 17.4.2 a medium severity vulnerability related to deploy keys CVE-2024-9623 was detected. This vulnerability allows attackers to push code to an archived repository, potentially leading to unauthorized changes or data breaches. To fix this issue, users should upgrade GitLab to versions 17.2.9, 17.3.5, or 17.4.2. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-9623.

In Portainer versions prior to 2.20.2 a critical severity vulnerability CVE-2024-33662 was detected. Portainer uses an improper encryption algorithm in the AesEncrypt function, which could allow attackers to exploit vulnerabilities. To fix this problem, users should upgrade to version 2.20.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-33662.

In Jenkins versions < 2.462.3 and >= 2.466, < 2.479 a medium severity vulnerability CVE-2024-47804 was detected. This vulnerability allows attackers to bypass item creation restrictions by saving an item to persist it, even if the creation is prohibited by access control checks. To address this issue, users must upgrade to version 2.462.3 or 2.479. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-47804.

In Jenkins versions 2.478 and earlier, and LTS 2.462.2 and earlier a medium severity vulnerability CVE-2024-47803 was detected. This vulnerability allows attackers to access multi-line secret values that are not redacted in error messages generated for form submissions involving the secretTextarea form field. To address this issue, users must upgrade to version 2.462.3 or 2.479. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-47803.

In Portainer versions earlier than 2.20.2 a high severity vulnerability CVE-2024-33662 was detected. This vulnerability allows attackers to exploit an improper use of an encryption algorithm in the AesEncrypt function. To address this issue, users must upgrade to version 2.20.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-33662.

In GitLab versions from 8.0 up to 16.4 a medium severity vulnerability CVE-2023-3441 was detected, allowing attackers to introduce unreviewed or malicious code into sensitive parts of a GitLab repository, which increases the risk of security breaches or data compromise. To fix this issue, users should upgrade to version 16.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2023-3441.

In OpenShift versions using the bind-propagation option in the Dockerfile RUN –mount instruction a medium severity vulnerability CVE-2024-9407 was detected. This vulnerability allows attackers to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-9407.

In OpenShift versions using FIPS OpenSSL a medium severity vulnerability CVE-2024-9355 was found. It allows attackers to return an uninitialized buffer in FIPS mode, leading to incorrect hash comparisons and the potential for a derived key to be all zeros. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-9355.