BuildPiperの脆弱性3件、修正版2.7.0あり・攻撃資料公開
Summary
CI/CDとデプロイを担うBuildPiperの2.7.0未満に、Kubernetesクラスター全体の乗っ取りやアカウント奪取につながる脆弱性が3件あります。使っている組織は2.7.0へ更新し、権限の付与状況も見直してください。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
CI/CDとデプロイを担うBuildPiperの2.7.0未満に、Kubernetesクラスター全体の乗っ取りやアカウント奪取につながる脆弱性が3件あります。使っている組織は2.7.0へ更新し、権限の付与状況も見直してください。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| OpsTree SolutionsBuildPiper |
< 2.7.0→ 2.7.0 |
2.7.0 |
Original description The description as published by the source.
OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise.
Source: CVE.org (CVE Program・cvelistV5) NVD