Mce-operator-bundle: all github actions pinned by mutable tag, not commit sha
A flaw was found in mce-operator-bundle. The build process fetches and executes scripts from a remote repository without performing integrity checks, such as commit pinning or signature verification. This allows a malicious actor with write access to the remote repository to inject and execute arbitrary code during the build. The consequence is a compromised build process, potentially leading to the distribution of malicious software.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
multicluster engine for Kubernetes 2.10
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.10
Platforms
Unknown
Default status
affected
Package
multicluster-engine/mce-operator-bundle
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.10 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787263075
unaffected
rpm
*
Unavailable
None listed
multicluster engine for Kubernetes 2.11
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.11
Platforms
Unknown
Default status
affected
Package
multicluster-engine/mce-operator-bundle
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.11 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787321579
unaffected
rpm
*
Unavailable
None listed
multicluster engine for Kubernetes 2.17
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.17
Platforms
Unknown
Default status
affected
Package
multicluster-engine/mce-operator-bundle
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.17 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787083639
unaffected
rpm
*
Unavailable
None listed
multicluster engine for Kubernetes 2.6
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.6
Platforms
Unknown
Default status
affected
Package
multicluster-engine/mce-operator-bundle
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.6 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787317415
unaffected
rpm
*
Unavailable
None listed
multicluster engine for Kubernetes 2.8
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.8
Platforms
Unknown
Default status
affected
Package
multicluster-engine/mce-operator-bundle
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.8 · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
1787318262
unaffected
rpm
*
Unavailable
None listed
multicluster engine for Kubernetes 2.9
Vendor
Red Hat
Product
multicluster engine for Kubernetes 2.9
Platforms
Unknown
Default status
affected
Package
multicluster-engine/mce-operator-bundle
Package collection
https://catalog.redhat.com/software/containers/
multicluster engine for Kubernetes 2.9 · Scoped product and version facts