User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables
are injected without quoting them either into command lines or into
manifests. This mostly applies to the Image URL and BMC credentials
(which are not verified by FakeFish).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
Affected products
openshift-metal3 · fakefish