attack vector is network; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products
suse neuvector
Classified as
CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
suse
neuvector
Subsystems
General OT
Sectors
Multiple
What to Know
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the complete compromise of the worker node. This affects NeuVector 5.4 before 5.4.11, NeuVector 5.5 before 5.5.4, NeuVector 5.6 before 5.6.2 and potentially older versions. (NVD)
What to Do
Monitor suse's web page for any future patch releases.