CVE-2024-5651
Description
A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying an arbitrary command to execute in the --ssh-path/--telnet-path arguments. A low-privilege user, for example, a user with developer access, can create a specially crafted FenceAgentsRemediation for a fence agent supporting --ssh-path/--telnet-path arguments to execute arbitrary commands on the operator's pod. This RCE leads to a privilege escalation, first as the service account running the operator, then to another service account with cluster-admin privileges.
How to fix
- fence-agents-remediation0.4.1-22 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fence-agents-remediation | 0.4.0 ≤ v < 0.4.1-22 | 0.4.1-22 |
| workload_availability_far 0.4 | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.