x/vulndb: potential Go vuln in open-cluster-management.io/ocm: GHSA-jhh6-6fhp-q2xp

[GoVulnBot]

Advisory GHSA-jhh6-6fhp-q2xp references a vulnerability in the following Go modules:

Module
open-cluster-management.io/ocm

Description:
A flaw was found in Open Cluster Management (OCM) when a user has access to the worker nodes which contain the cluster-manager or klusterlet deployments. The cluster-manager deployment uses a service account with the same name "cluster-manager" which is bound to a ClusterRole also named "cluster-manager", which includes the permission to create Pod resources. If this deployment runs a pod on an attacker-controlled node, the attacker can obtain the cluster-manager's token and steal any service account token by creating and mounting the target service account to control the whole cluster.

References:

• ADVISORY: GHSA-jhh6-6fhp-q2xp
• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-9779
• FIX: 🐛 Reduce permission for cluster manager and klusterlet open-cluster-management-io/ocm#325
• REPORT: A potential risk of operator makes a worker node get the token of any Service Account open-cluster-management-io/registration-operator#361
• WEB: https://access.redhat.com/security/cve/CVE-2024-9779
• WEB: https://bugzilla.redhat.com/show_bug.cgi?id=2317916
• WEB: https://github.com/open-cluster-management-io/ocm/releases/tag/v0.13.0

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: open-cluster-management.io/ocm
      versions:
        - fixed: 0.13.0
      vulnerable_at: 0.12.0
summary: Open Cluster Management vulnerable to Trust Boundary Violation in open-cluster-management.io/ocm
cves:
    - CVE-2024-9779
ghsas:
    - GHSA-jhh6-6fhp-q2xp
references:
    - advisory: https://github.com/advisories/GHSA-jhh6-6fhp-q2xp
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-9779
    - fix: https://github.com/open-cluster-management-io/ocm/pull/325
    - report: https://github.com/open-cluster-management-io/registration-operator/issues/361
    - web: https://access.redhat.com/security/cve/CVE-2024-9779
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=2317916
    - web: https://github.com/open-cluster-management-io/ocm/releases/tag/v0.13.0
source:
    id: GHSA-jhh6-6fhp-q2xp
    created: 2024-12-18T16:01:17.997160894Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/638116 mentions this issue: data/reports: add 6 unreviewed reports

[gopherbot]

Change https://go.dev/cl/637956 mentions this issue: data/reports: add 6 unreviewed reports