Description (CNA)
Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| operator-framework / operator-sdk | affected 0 before 0.15.2 |
| Red Hat / RHEL-9-CNV-4.17 | unaffected v4.17.39-2 before * |
| Red Hat / RHEL-9-CNV-4.18 | unaffected v4.18.25-3 before * |
| Red Hat / RHEL-9-CNV-4.20 | unaffected v4.20.3-3 before * |
| Red Hat / multicluster engine for Kubernetes 2.6 | unaffected v2.6 before * |
| Red Hat / multicluster engine for Kubernetes 2.6 | unaffected v2.6 before * |
| Red Hat / multicluster engine for Kubernetes 2.6 | unaffected v2.6 before * |
| Red Hat / multicluster engine for Kubernetes 2.6 | unaffected v2.6 before * |
| Red Hat / multicluster engine for Kubernetes 2.6 | unaffected v2.6 before * |
| Red Hat / multicluster engine for Kubernetes 2.6 | unaffected v2.6 before * |
| Red Hat / multicluster engine for Kubernetes 2.6 | unaffected v2.6 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.7 | unaffected v2.7 before * |
| Red Hat / multicluster engine for Kubernetes 2.8 | unaffected 1765872406 before * |
| Red Hat / multicluster engine for Kubernetes 2.8 | unaffected 1766360304 before * |
| Red Hat / multicluster engine for Kubernetes 2.8 | unaffected 1765669648 before * |
| Red Hat / multicluster engine for Kubernetes 2.8 | unaffected 1765866268 before * |
| Red Hat / multicluster engine for Kubernetes 2.8 | unaffected 1765872399 before * |
| Red Hat / multicluster engine for Kubernetes 2.8 | unaffected 1765872402 before * |
| Red Hat / multicluster engine for Kubernetes 2.8 | unaffected 1765872398 before * |
| Red Hat / multicluster engine for Kubernetes 2.8 | unaffected 1765872400 before * |
| Red Hat / multicluster engine for Kubernetes 2.9 | unaffected v2.9 before * |
| Red Hat / multicluster engine for Kubernetes 2.9 | unaffected v2.9 before * |
| Red Hat / multicluster engine for Kubernetes 2.9 | unaffected v2.9 before * |
| Red Hat / multicluster engine for Kubernetes 2.9 | unaffected v2.9 before * |
| Red Hat / multicluster engine for Kubernetes 2.9 | unaffected v2.9 before * |
| Red Hat / multicluster engine for Kubernetes 2.9 | unaffected v2.9 before * |
| Red Hat / multicluster engine for Kubernetes 2.9 | unaffected v2.9 before * |
| Red Hat / multicluster engine for Kubernetes 2.9 | unaffected v2.9 before * |
| Red Hat / OpenShift Compliance Operator 1 | unaffected 1.8.0 before * |
| Red Hat / OpenShift Compliance Operator 1 | unaffected 1768172669 before * |
| Red Hat / OpenShift File Integrity Operator - FIO 1 | unaffected v1.3 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11 | unaffected v2.11 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11 | unaffected v2.11 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11 | unaffected v2.11 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.11 | unaffected v2.11 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.12 | unaffected v2.12 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.12 | unaffected v2.12 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.12 | unaffected v2.12 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.12 | unaffected v2.12 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.12 | unaffected v2.12 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.12 | unaffected v2.12 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.12 | unaffected v2.12 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.12 | unaffected 1773285089 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.12 | unaffected 1773259164 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.12 | unaffected 1773259182 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.12 | unaffected 1773358651 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.12 | unaffected 1773090513 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.13 | unaffected 1767569821 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.13 | unaffected 1767829032 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.13 | unaffected 1767569821 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.13 | unaffected 1767656229 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.13 | unaffected 1767829032 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14 | unaffected v2.14 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14 | unaffected v2.14 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14 | unaffected v2.14 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14 | unaffected v2.14 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14 | unaffected v2.14 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14 | unaffected v2.14 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14 | unaffected 1769720041 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14 | unaffected 1770343757 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14 | unaffected 1769721579 before * |
| Red Hat / Red Hat Advanced Cluster Management for Kubernetes 2.14 | unaffected 1770336554 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178221 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178222 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178236 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178273 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178715 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178261 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178354 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178419 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178768 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178319 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178386 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178406 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178615 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178379 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178329 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178423 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764178419 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.14 | unaffected v4.14-1764215448 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.15 | unaffected v4.15-1764176261 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.15 | unaffected v4.15-1764176342 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.15 | unaffected v4.15-1764176372 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.15 | unaffected v4.15-1764176892 before * |
| Red Hat / Red Hat Openshift Data Foundation 4.15 | unaffected v4.15-1764176485 before * |
CWE
CWE-276
References
- https://access.redhat.com/errata/RHEA-2025:23406
- https://access.redhat.com/errata/RHEA-2025:23478
- https://access.redhat.com/errata/RHEA-2026:0129
- https://access.redhat.com/errata/RHSA-2025:19332
- https://access.redhat.com/errata/RHSA-2025:19335
- https://access.redhat.com/errata/RHSA-2025:19958
- https://access.redhat.com/errata/RHSA-2025:19961
- https://access.redhat.com/errata/RHSA-2025:21368
- https://access.redhat.com/errata/RHSA-2025:21885
- https://access.redhat.com/errata/RHSA-2025:22415
- https://access.redhat.com/errata/RHSA-2025:22416
- https://access.redhat.com/errata/RHSA-2025:22418
- https://access.redhat.com/errata/RHSA-2025:22420
- https://access.redhat.com/errata/RHSA-2025:22683
- https://access.redhat.com/errata/RHSA-2025:22684
- https://access.redhat.com/errata/RHSA-2025:23528
- https://access.redhat.com/errata/RHSA-2025:23529
- https://access.redhat.com/errata/RHSA-2025:23542
- https://access.redhat.com/errata/RHSA-2026:0627
- https://access.redhat.com/errata/RHSA-2026:0718
- https://access.redhat.com/errata/RHSA-2026:0722
- https://access.redhat.com/errata/RHSA-2026:0737
- https://access.redhat.com/errata/RHSA-2026:2572
- https://access.redhat.com/errata/RHSA-2026:5633
- https://access.redhat.com/security/cve/CVE-2025-7195
- https://bugzilla.redhat.com/show_bug.cgi?id=2376300
ADP enrichment
No English description supplied.
No references supplied.