Threats tagged 'ghsa-vhfq-9q32-q69f'

A vulnerability in openshift-ansible's installer container run script allows downloading and executing remote inventory and dynamic scripts without verifying their integrity. An attacker with network-level access or control over the remote script server could substitute malicious executables, which would run with the installer's user ID and full cluster provisioning privileges, enabling arbitrary code execution. The risk is limited to environments that use remote inventory sources via environment variables and is mitigated by securing network communications and using HTTPS with trusted servers.