The vulnerability CVE-2024-45497 exists in the OpenShift build process due to the docker-build container being configured with a hostPath volume mount that maps the node's /var/lib/kubelet/config.json file into the build pod with write permissions. This file contains credentials necessary for pulling images from private repositories. Because the mount is not read-only, an attacker with access to the build pod can overwrite this file, leading to denial of service by preventing the node from pulling new images and potentially exfiltrating sensitive secrets. This flaw impacts the availability of services dependent on image pulls and exposes sensitive information to unauthorized parties. Red Hat has issued security advisories and updated container images and packages for OpenShift Container Platform versions 4.16 and 4.17 to fix this issue.

The vulnerability allows an attacker to overwrite critical node pull credentials stored in /var/lib/kubelet/config.json, which can cause denial of service by blocking image pulls on the node. Additionally, sensitive credentials may be exfiltrated, leading to unauthorized access to private image repositories. This impacts the availability of services relying on image pulls and compromises confidentiality of secrets.

Red Hat has released updated packages and container images for OpenShift Container Platform versions 4.16 and 4.17 that fix this vulnerability. Users are advised to upgrade to OpenShift Container Platform 4.16.78 or later and 4.17.35 or later as soon as these updates are available in their release channels. The vendor manages remediation through these official fixes. Instructions for upgrading clusters are available in the Red Hat OpenShift documentation. Patch status is confirmed by Red Hat advisories RHSA-2025:10270 and RHSA-2025:10294.