VM images built with Image Builder with some providers use default credentials during builds

A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers. The credentials can be used to gain root access. The credentials are disabled at the conclusion of the image build process. Kubernetes clusters are only affected if their nodes use VM images created via the Image Builder project. Because these images were vulnerable during the image build process, they are affected only if an attacker was able to reach the VM where the image build was happening and used the vulnerability to modify the image at the time the image build was occurring.

CVSS:3.1/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

使用硬编码的凭证

Image Builder 安全漏洞

Image Builder是Kubernetes SIGs开源的一个跨多个基础设施提供商构建 Kubernetes 虚拟机映像的工具。 Image Builder v0.1.37版本及之前版本存在安全漏洞，该漏洞源于在使用 Nutanix、OVA、QEMU 或原始提供程序时，在映像构建过程中启用了默认凭据。

N/A

N/A