Detections
Analytics
SCA: security update for github.com/kubernetes-sigs/image-builder (GHSA-8jpg-62jc-hwhr)
medium Tenable Self-Hosted Container Security Plugin ID 412739
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- A security issue was discovered in the Kubernetes Image Builder versions <= v0.1.37 where default
credentials are enabled during the image build process when using the Nutanix, OVA, QEMU or raw providers.
The credentials can be used to gain root access. The credentials are disabled at the conclusion of the
image build process. Kubernetes clusters are only affected if their nodes use VM images created via the
Image Builder project. Because these images were vulnerable during the image build process, they are
affected only if an attacker was able to reach the VM where the image build was happening and used the
vulnerability to modify the image at the time the image build was occurring. (CVE-2024-9594)
See Also
Plugin Details
Severity: Medium
ID: 412739
Version: Revision 1.7
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.58
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: High
Base Score: 7.6
Temporal Score: 5.6
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2024-9594
CVSS v3
Risk Factor: High
Base Score: 8.1
Temporal Score: 7.1
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 5.4
Threat Score: 2
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 10/15/2024
Vulnerability Publication Date: 10/15/2024
Reference Information
CVE: CVE-2024-9594
cwe: CWE-798