CVE-2024-25131

Name of the Vulnerable Software and Affected Versions OpenShift Dedicated versions prior to v0.0.0-20240604173837-d1557bc283dd

Description A flaw was found in the MustGather.managed.openshift.io Custom Defined Resource (CRD) of OpenShift Dedicated. This issue allows a non-privileged user on the cluster to create a MustGather object with a specially crafted file and set the most privileged service account to run the job, potentially escalating their privileges to a cluster administrator and pivoting to the AWS environment.

Recommendations For OpenShift Dedicated versions prior to v0.0.0-20240604173837-d1557bc283dd, update to version v0.0.0-20240604173837-d1557bc283dd or later to resolve the issue. As a temporary workaround, consider restricting access to the MustGather CRD to prevent non-privileged users from creating specially crafted files.