CVE-2024-13484

HIGH8.2

Openshift-gitops-operator-container: namespace isolation break

Published Jan 28, 2025

Modified 1 months ago

No fix available

Details

A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.

References

ADVISORYhttps://access.redhat.com/errata/RHSA-2025:7753 ADVISORYhttps://access.redhat.com/errata/RHSA-2025:8274 ADVISORYhttps://access.redhat.com/errata/RHSA-2025:9506 WEBhttps://access.redhat.com/security/cve/CVE-2024-13484 WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=2269376 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2024-13484

CVSS Analysis

CVSS v3.1

8.2

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

HighPR:H

User Interaction

NoneUI:N

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

HighI:H

Availability

HighA:H

8.2/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness Type (CWE)

Other

CWE-668

Ecosystems

Timeline

PublishedJan 28, 2025

ModifiedNov 20, 2025