Security readout for executives and security teams
Plain-English summary
A developer-level OpenShift user could abuse the build process to run commands on a worker node. Because the affected Git-clone container receives privileged access, successful abuse could compromise the node and threaten workloads or data hosted there.
Executive priority
Prioritize remediation for clusters where developers or less-trusted tenants can create builds. Treat internet-facing or multi-tenant development environments as urgent because one compromised developer account could lead to worker-node control. Coordinate update testing promptly rather than delaying for evidence of exploitation.
Technical view
During build initialization, OpenShift runs the Git-clone container with a privileged security context. A developer can supply a crafted .gitconfig that causes commands to execute during cloning, enabling arbitrary worker-node command execution and privilege escalation. The supplied CVSS 3.1 score is 9.9.
Likely exposure
The bundle identifies affected Red Hat OpenShift Container Platform records spanning releases 4.12 through 4.18. Exposure requires developer-level access and use of the vulnerable build path. Exact package applicability, particularly among the listed 4.18 records, should be confirmed against Red Hat advisories.
Exploitation context
The vulnerability is remotely reachable by an authenticated, low-privileged developer without user interaction. The bundle marks it absent from KEV and provides no evidence of active exploitation or a public exploit. Its impact remains severe because successful abuse reaches the worker node.
Researcher notes
The core trust-boundary failure is privileged Git cloning influenced by developer-controlled configuration. Validate RBAC access to build creation, affected package versions, and node-level telemetry. The supplied 4.18 package entries include components not obviously matching controller-manager, so confirm applicability with Red Hat rather than treating every listed package as causal.
Mitigation direction
- Apply applicable Red Hat OpenShift security updates listed in the referenced advisories after confirming release and package applicability.
- Restrict developer access and build-creation permissions until affected clusters are updated.
- Consult Red Hat guidance before using temporary workarounds; none is specified in the supplied evidence.
Validation and detection
- Inventory cluster versions and determine whether the affected Red Hat OpenShift 4.12 through 4.18 records apply.
- Compare installed OpenShift controller-manager packages with the applicable Red Hat security advisories.
- Review audit and node telemetry for unexpected commands or privileged build-pod activity during Git cloning.
- After updating, verify affected components match vendor-corrected package versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-269: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupContainer behavior lookup
The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-45496 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.9 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L3.16redhatVulnerability scoring details
Base CVSS 3.1 score
9.9CriticalVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- Source timelineredhat
Made public.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2024:3718CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:6122CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:6685CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:6687CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:6689CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:6691CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2024:6705CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-45496CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2308661CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Privilege Management
Improper Privilege Management represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.