From f9985183f48e22e6bbe153b32506c93b76419195 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 17 Sep 2024 18:33:04 +0000
Subject: [PATCH] Publish Advisories

GHSA-qqv8-ph7f-h3f7
GHSA-qqv8-ph7f-h3f7
---
 .../GHSA-qqv8-ph7f-h3f7.json                  | 73 +++++++++++++++++++
 .../GHSA-qqv8-ph7f-h3f7.json                  | 42 -----------
 2 files changed, 73 insertions(+), 42 deletions(-)
 create mode 100644 advisories/github-reviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json
 delete mode 100644 advisories/unreviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json

diff --git a/advisories/github-reviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json b/advisories/github-reviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json
new file mode 100644
index 00000000000..a121918042a
--- /dev/null
+++ b/advisories/github-reviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json
@@ -0,0 +1,73 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-qqv8-ph7f-h3f7",
+  "modified": "2024-09-17T18:31:42Z",
+  "published": "2024-09-17T00:31:06Z",
+  "aliases": [
+    "CVE-2024-7387"
+  ],
+  "summary": "OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer",
+  "details": "A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the \"Docker\" strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
+    },
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/openshift/builder"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "last_affected": "4.0.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7387"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/openshift/builder/commit/0b62633adfa2836465202bc851885e078ec888d1"
+    },
+    {
+      "type": "WEB",
+      "url": "https://access.redhat.com/security/cve/CVE-2024-7387"
+    },
+    {
+      "type": "WEB",
+      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302259"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/openshift/builder"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-250"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-09-17T18:31:41Z",
+    "nvd_published_at": "2024-09-17T00:15:52Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json b/advisories/unreviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json
deleted file mode 100644
index d9190c4f87a..00000000000
--- a/advisories/unreviewed/2024/09/GHSA-qqv8-ph7f-h3f7/GHSA-qqv8-ph7f-h3f7.json
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-qqv8-ph7f-h3f7",
-  "modified": "2024-09-17T00:31:06Z",
-  "published": "2024-09-17T00:31:06Z",
-  "aliases": [
-    "CVE-2024-7387"
-  ],
-  "details": "A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
-    }
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7387"
-    },
-    {
-      "type": "WEB",
-      "url": "https://access.redhat.com/security/cve/CVE-2024-7387"
-    },
-    {
-      "type": "WEB",
-      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2302259"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-250"
-    ],
-    "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2024-09-17T00:15:52Z"
-  }
-}
\ No newline at end of file