{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"4.0.0"}],"component":"github.com/openshift/builder","cve_ids":["CVE-2024-7387"],"ecosystem":"Go","epss":0.02321,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-qqv8-ph7f-h3f7","id":"tcs_01M5KFKE1EYX9WKK0R22731PBH","modified_at":"2026-08-11T18:45:13.792080336Z","published_at":"2024-09-17T00:31:06Z","references":["https://osv.dev/vulnerability/GHSA-qqv8-ph7f-h3f7","https://nvd.nist.gov/vuln/detail/CVE-2024-7387","https://github.com/openshift/builder/commit/0b62633adfa2836465202bc851885e078ec888d1","https://access.redhat.com/errata/RHSA-2024:3718","https://access.redhat.com/errata/RHSA-2024:6122","https://access.redhat.com/errata/RHSA-2024:6685","https://access.redhat.com/errata/RHSA-2024:6687","https://access.redhat.com/errata/RHSA-2024:6689","https://access.redhat.com/errata/RHSA-2024:6691","https://access.redhat.com/errata/RHSA-2024:6705","https://access.redhat.com/security/cve/CVE-2024-7387","https://bugzilla.redhat.com/show_bug.cgi?id=2302259","https://github.com/openshift/builder","https://pkg.go.dev/vuln/GO-2024-3129","https://stuxxn.github.io/advisory/2024/10/02/openshift-build-docker-priv-esc.html"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-qqv8-ph7f-h3f7","url":"https://osv.dev/vulnerability/GHSA-qqv8-ph7f-h3f7"}],"summary":"OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer"}