CVE-2024-13484
Published: 28 January 2025
Description
A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.
Security Summary
CVE-2024-13484 is a vulnerability in the openshift-gitops-operator-container, associated with CWE-668. The flaw occurs because the openshift.io/cluster-monitoring label is automatically applied to all namespaces that deploy an ArgoCD Custom Resource (CR) instance. This labeling enables those namespaces to create a rogue PrometheusRule, which is then rolled out cluster-wide due to the label, resulting in adverse effects on the platform monitoring stack.
The vulnerability has a CVSS v3.1 base score of 8.2 (AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Exploitation requires local access and high privileges within the affected OpenShift environment. A privileged attacker can deploy an ArgoCD CR instance in a namespace, trigger the application of the cluster-monitoring label, and create a malicious PrometheusRule that propagates cluster-wide, potentially compromising confidentiality, integrity, and availability of the monitoring stack with high impact.
Red Hat has issued multiple errata addressing this issue, including RHSA-2025:7753, RHSA-2025:8274, and RHSA-2025:9506. Further details on the vulnerability and mitigation steps are available in the Red Hat CVE page at https://access.redhat.com/security/cve/CVE-2024-13484 and the Bugzilla tracker at https://bugzilla.redhat.com/show_bug.cgi?id=2269376.
Details
- CWE(s)