Antoine Ardino

**Name of the Vulnerable Software and Affected Versions** NooBaa (affected versions not specified) **Description** An OS command injection flaw exists in the `set hostname internal()` function of the 'cluster internal api' component, which manages the Multi-Cloud Object Gateway in OpenShift Data Foundation. The issue arises because the `hostname` parameter is passed to a shell command without proper sanitization. An authenticated attacker with administrative privileges can use a specially crafted `hostname` containing shell metacharacters to execute arbitrary commands on the host system with the privileges of the NooBaa process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.