CVE-2024-5651

Name	CVE-2024-5651
Description	A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying an arbitrary command to execute in the --ssh-path/--telnet-path arguments. A low-privilege user, for example, a user with developer access, can create a specially crafted FenceAgentsRemediation for a fence agent supporting --ssh-path/--telnet-path arguments to execute arbitrary commands on the operator's pod. This RCE leads to a privilege escalation, first as the service account running the operator, then to another service account with cluster-admin privileges.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
fence-agents (PTS)	jessie	3.1.5-2	vulnerable
	stretch	4.0.25-1+deb9u2	fixed
	buster	4.3.3-2+deb10u1	vulnerable
	bullseye	4.7.1-1	fixed
	bookworm	4.12.1-1	fixed
	sid, trixie	4.15.0-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency
fence-agents	source	jessie	(unfixed)	end-of-life
fence-agents	source	buster	(unfixed)	end-of-life
fence-agents	source	(unstable)	(not affected)

Notes

- fence-agents <not-affected> (Vulnerability specific to Fence Agents Remediation operator in Red Hat, cf #1078970)
https://bugzilla.redhat.com/show_bug.cgi?id=2290540
[stretch] - fence-agents <postponed> (Minor issue)