CVE-2024-1725
Fixed in a distro release EPSS <1%CVSS 6.5
A flaw was found in the kubevirt-csi component of OpenShift Virtualization's Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node's volume by creating a custom Persistent Volume that matches the name of a worker node.
Products: Red Hat OpenShift Container Platform 4.13, Red Hat OpenShift Container Platform 4.14, Red Hat OpenShift Container Platform 4.15
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/kubevirt/csi-driver | 0.0.0-202403081943-cc28dcbb0afc14 |
| Go | github.com/kubevirt/csi-driver | no fix |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250313T170021-1.1 |