* Salvatore Bonaccorso [Sun Aug 18, 2024 at 02:19:09PM +0200]: > The following vulnerability was published for fence-agents. > > CVE-2024-5651[0]: > | A flaw was found in fence agents that rely on SSH/Telnet. This > | vulnerability can allow a Remote Code Execution (RCE) primitive by > | supplying an arbitrary command to execute in the --ssh- > | path/--telnet-path arguments. A low-privilege user, for example, a > | user with developer access, can create a specially crafted > | FenceAgentsRemediation for a fence agent supporting --ssh- > | path/--telnet-path arguments to execute arbitrary commands on the > | operator's pod. This RCE leads to a privilege escalation, first as > | the service account running the operator, then to another service > | account with cluster-admin privileges. > > Unfortunately, at time of writing this bugreport, the only reference I > have found for this CVE is the one linked in the CVE entry is [1]. > > If you fix the vulnerability please also make sure to include the > CVE (Common Vulnerabilities & Exposures) id in your changelog entry. > > For further information see: > > [0] https://security-tracker.debian.org/tracker/CVE-2024-5651 > https://www.cve.org/CVERecord?id=CVE-2024-5651 > [1] https://bugzilla.redhat.com/show_bug.cgi?id=2290540 > > Please adjust the affected versions in the BTS as needed.
Quoting Marc Deslauriers from https://ubuntu.com/security/CVE-2024-5651: | I don't believe this affects the fence-agents package in Ubuntu | as the Red Hat advisory states "This vulnerability is specific | to the Fence Agents Remediation operator and does not affect | fence-agents itself." and the string "FenceAgentsRemediation" | isn't in the fence-agents package. Marking as deferred for now. Also upstream doesn't seem to have anything about it at https://github.com/ClusterLabs/fence-agents, so feels really like being a RedHat specific issue and we should downgrade the severity of this RC bug, which currently prevents fence-agents being available in trixie? regards -mika-
signature.asc
Description: PGP signature
