CVE-2024-33394

Aliases:GHSA-4q63-mr2m-57hfGO-2024-2816CGA-98r3-fqj9-xgg5CGA-2c6v-v3m8-p878CGA-2h52-34gv-p224CGA-2vgm-9j7r-vwwmCGA-342v-7gf3-jfg4CGA-34wf-xvqv-pcqvCGA-3hm6-g9cf-3h4gCGA-3jxf-8q72-g226CGA-3pw8-4cq2-97hgCGA-3x33-h4jh-949mCGA-47fp-cq36-j69rCGA-4xx2-jg5j-gq9fCGA-52v5-w8v7-q99vCGA-56gm-5g74-5wcfCGA-59wh-3f6w-j256CGA-5fh8-p48v-x7w3CGA-5g2q-g9xh-4gx7CGA-5hcp-76pc-4947CGA-5mhg-r7fv-q7m9CGA-5pcg-c7j6-wp2wCGA-637w-gx4j-85h6CGA-64r6-w6r7-hmpgCGA-64vm-298q-4hm7CGA-65ww-q4qh-xj95CGA-6jm4-ch7f-6c2rCGA-6pf8-vvgj-36rjCGA-74r7-hghw-fgxxCGA-777x-6vm9-98mqCGA-77x9-636j-47fxCGA-7999-ghwp-2hcvCGA-7gxc-86rp-pr33CGA-7mh7-qr6v-c4h8CGA-7r58-2m47-jmj8CGA-7wg6-mm7w-rjppCGA-835g-fm72-8c42CGA-8g46-8pf5-9w2rCGA-8h9j-v8pf-6wpgCGA-8jxx-vg2p-f9jgCGA-8p4j-qggq-543hCGA-8q5p-hhch-c36qCGA-8qw5-2jvx-q2q3CGA-8rq9-hqj6-p445CGA-959v-wfvr-57hgCGA-9f5g-2rqp-r987CGA-9hqh-8cr7-j4hrCGA-9pjj-98w8-pf9fCGA-9q7r-jmx2-p65hCGA-9rvm-mw7q-53gpCGA-9v3c-rhqg-x6mqCGA-9x8j-952q-29jqCGA-c572-4m8x-h7j4CGA-c9xp-mfv4-65vhCGA-ch3h-pmgf-x95qCGA-cjgm-862c-7c6gCGA-cm69-7r2x-xv7wCGA-cp69-c7r2-2pmgCGA-fcch-9jqw-x2p7CGA-fffx-79wr-764wCGA-fjjg-h655-5hx4CGA-fwrp-phm9-q4f2CGA-h5c6-7p7q-pw86CGA-hgcj-9945-m7gfCGA-hjc6-q6x7-qm26CGA-j37w-v3cp-76r8CGA-j9fc-h762-3443CGA-m583-jqx7-mm65CGA-m7jq-6337-96cgCGA-mcpc-857r-4xhcCGA-mfj6-4hmm-69cfCGA-mfr8-mqw6-x8xrCGA-mq62-47ff-2mj4CGA-p38x-2vfp-r4x4CGA-p3jh-89h3-vr48CGA-pgwv-fpj9-rh42CGA-ppx8-4wc6-vx6wCGA-pvcv-8329-rmgcCGA-pw6v-mjhf-qjw3CGA-q23h-ppj8-cwx6CGA-q28j-3pf9-f887CGA-q3xf-xwx2-2g6pCGA-q4q2-cwrq-mxmpCGA-q8g6-w92q-fmj7CGA-q962-35fp-386wCGA-q96f-jh94-559qCGA-qhr9-9chp-8fxfCGA-qphg-7m23-qq96CGA-r8f7-87p9-xxcjCGA-rcm2-6jhg-c5wxCGA-rp4j-g9wr-q8h9CGA-rq98-3j24-jc6fCGA-vc2r-5fm2-8g7cCGA-vj3w-557f-q6pqCGA-vpp3-pv4q-phf6CGA-vr7j-6ghm-3cx9CGA-w3x5-rh7j-82w5CGA-w6rg-jpmf-6xhpCGA-w7c2-wc3p-3x37CGA-wgf2-6282-jph2CGA-wwfc-f2pr-fwqvCGA-x229-cfqh-qfjhCGA-x9m5-6hp6-m897CGA-xcw7-pffq-g98hCGA-xgjg-6892-q527CGA-xgxq-x9x9-whp7CGA-xprf-9wg6-69h5CGA-xvr2-769v-5pg5
Advisory lineage Upstream: 0 Downstream: 5
Analyzed
Published: 02 May 2024, 00:00
Last modified:02 Aug 2024, 02:27

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
5.9 MEDIUM
v3.1 (cve.org)
EPSS Score
0.33% LOW
0% probability +0.28%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

02 May 2024, 00:00
Published
Vulnerability first disclosed
02 Aug 2024, 02:27
Last Modified
Vulnerability information updated

Description

An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token component.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.9CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

EPSS Trends

Current EPSS score: 0.33%• Percentile: 26%

Techniques & Countermeasures

  • CWE-94•Improper Control of Generation of Code ('Code Injection')

    The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected Systems

  • chainguard•docker-machine-driver-harvester

    < 0

  • chainguard•harvester

    < 1.8.1-r1

  • chainguard•harvester-fips

    < 1.8.1-r0

  • chainguard•harvester-fips-upgrade-helper

    < 1.8.1-r0

  • chainguard•harvester-fips-webhook

    < 1.8.1-r0

  • chainguard•harvester-upgrade-helper

    < 1.8.1-r1

  • chainguard•harvester-webhook

    < 1.8.1-r1

  • chainguard•virt-api-1.6

    < 0

  • chainguard•virt-api-1.7

    < 0

  • chainguard•virt-api-1.8

    < 0

  • chainguard•virt-api-fips-1.6

    < 0

  • chainguard•virt-api-fips-1.7

    < 0

  • chainguard•virt-api-fips-1.8

    < 0

  • chainguard•virt-chroot-1.6

    < 0

  • chainguard•virt-chroot-1.7

    < 0

  • chainguard•virt-chroot-1.8

    < 0

  • chainguard•virt-chroot-fips-1.6

    < 0

  • chainguard•virt-chroot-fips-1.7

    < 0

  • chainguard•virt-chroot-fips-1.8

    < 0

  • chainguard•virt-controller-1.6

    < 0

  • chainguard•virt-controller-1.7

    < 0

  • chainguard•virt-controller-1.8

    < 0

  • chainguard•virt-controller-fips-1.6

    < 1.6.6-r2

  • chainguard•virt-controller-fips-1.7

    < 0

  • chainguard•virt-controller-fips-1.8

    < 0

  • chainguard•virt-handler-1.6

    < 0

  • chainguard•virt-handler-1.7

    < 0

  • chainguard•virt-handler-1.8

    < 0

  • chainguard•virt-handler-fips-1.6

    < 0

  • chainguard•virt-handler-fips-1.7

    < 0

  • chainguard•virt-handler-fips-1.8

    < 0

  • chainguard•virt-launcher-1.6

    < 1.6.6-r3

  • chainguard•virt-launcher-1.6-virt-freezer

    < 1.6.6-r3

  • chainguard•virt-launcher-1.6-virt-launcher-monitor

    < 1.6.6-r3

  • chainguard•virt-launcher-1.6-virt-probe

    < 1.6.6-r3

  • chainguard•virt-launcher-1.6-virt-tail

    < 1.6.6-r3

  • chainguard•virt-launcher-1.7

    < 1.7.4-r2

  • chainguard•virt-launcher-1.7-virt-freezer

    < 1.7.4-r2

  • chainguard•virt-launcher-1.7-virt-launcher-monitor

    < 1.7.4-r2

  • chainguard•virt-launcher-1.7-virt-probe

    < 1.7.4-r2

  • chainguard•virt-launcher-1.7-virt-tail

    < 1.7.4-r2

  • chainguard•virt-launcher-1.8

    < 1.8.4-r0

  • chainguard•virt-launcher-1.8-libvirt-hook-client

    < 1.8.4-r0

  • chainguard•virt-launcher-1.8-virt-freezer

    < 1.8.4-r0

  • chainguard•virt-launcher-1.8-virt-launcher-monitor

    < 1.8.4-r0

  • chainguard•virt-launcher-1.8-virt-probe

    < 1.8.4-r0

  • chainguard•virt-launcher-1.8-virt-tail

    < 1.8.4-r0

  • chainguard•virt-operator-1.6

    < 1.6.6-r1

  • chainguard•virt-operator-1.7

    < 0

  • chainguard•virt-operator-1.8

    < 0

Showing first 50 affected entries in server-rendered view.

References (5)