CVE-2025-7195

Description

Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15.2 provided a script, user_setup, which modifies the permissions of the /etc/passwd file to 664 during build time. Developers who used Operator-SDK before 0.15.2 to scaffold their operator may still be impacted by this if the insecure user_setup script is still being used to build new container images. In affected images, the /etc/passwd file is created during build time with group-writable permissions and a group ownership of root (gid=0). An attacker who can execute commands within an affected container, even as a non-root user, may be able to leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container.

Gravité et risque d'exploitation

CVE-2025-7195 obtient un score CVSS de 6.4/10, soit une gravité moyenne. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.23 %, ce qui la place devant 12.8 % des CVE référencées.

Que faire ?

• Vérifiez si operator-sdk (versions v4.14-1764178379, v4.18-1761854493, 1770343757, v4.18-1761854484, 0, 1769720041, v4.16-1764169479, v4.15-1764176958, v4.18-1761854280, v4.17-1764168431, <*, 1768172669, v4.15-1764177174, v4.14-1764178273, v2.7, v4.16-1764169710, 1769721579, v2.12, 1773090513, 1767569821, v4.16-1764169464, v4.14-1764178329, v4.16-1764169544, v4.17-1764167826, v4.16-1764169526, v2.14, v4.14-1764178615, v4.15-1764176485, v4.18-1761855467, v4.14-1764178319, v4.14-1764178236, v4.18-1761854321, 1766360304, v4.15-1764222436, v4.15-1764176699, v4.16-1764169577, v4.15-1764177033, v4.16-1764169598, 1765872402, 1765866268, v4.16-1764169457, 1765669648, 1765872400, 1765872406, v4.20.3-3, v4.18-1761854289, v4.14-1764178354, v4.14-1764178768, v4.15-1764177101, v4.16-1764169687, v4.18-1761854457, <0.15.2, v4.15-1764176698, v4.16-1764170021, 1773285089, v4.18-1761854489, v4.18-1761854422, 1.8.0, 1765872398, v4.17.39-2, 1767829032, v4.18.25-3, v4.14-1764178221, v4.14-1764178715, v1.3, v4.14-1764178386, v4.14-1764178423, v4.17-1764168536, 1770336554, v4.17-1764168179, v4.15-1764176261, v4.15-1764176342, v4.17-1764168731, 1773259182, v4.17-1764168662, v2.11, v4.14-1764178222, v4.15-1764176892, v4.18-1761854430, v4.16-1764169347, v4.18-1761854494, v4.17-1764168699, 1765872399, v2.9, v4.18-1761854398, 1773358651, v4.15-1764177029, v4.15-1764221806, v2.6, v4.16-1764169118, v4.15-1764176372, v4.14-1764215448, v4.17-1764168609, v4.14-1764178261, v4.17-1764168859, v4.16-1764170019, 1773259164, v4.15-1764177020, v4.15-1764176690, v4.17-1764167987, v4.17-1764168476, v4.16-1764169623, v4.18-1761854319, v4.16-1764169242, v4.14-1764178419, v4.16-1764169527, v4.17-1764169125, v4.17-1764167795, v4.18-1761855549, v4.18-1761854504, v4.17-1764167834, v4.18-1762335558, v4.17-1764169222, v4.18-1761855234, v4.17-1764168475, v4.17-1764169063, v4.17-1764167876, v4.18-1761854524, 1767656229, v4.16-1764169730, v4.14-1764178406, v4.15-1764176675, v4.16-1764168955) est présent sur votre parc.
• Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
• À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
• Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

• https://access.redhat.com/errata/RHEA-2025:23406
• https://access.redhat.com/errata/RHEA-2025:23478
• https://access.redhat.com/errata/RHEA-2026:0129
• https://access.redhat.com/errata/RHSA-2025:19332
• https://access.redhat.com/errata/RHSA-2025:19335
• https://access.redhat.com/errata/RHSA-2025:19958
• https://access.redhat.com/errata/RHSA-2025:19961
• https://access.redhat.com/errata/RHSA-2025:21368
• https://access.redhat.com/errata/RHSA-2025:21885
• https://access.redhat.com/errata/RHSA-2025:22415
• https://access.redhat.com/errata/RHSA-2025:22416
• https://access.redhat.com/errata/RHSA-2025:22418
• https://access.redhat.com/errata/RHSA-2025:22420
• https://access.redhat.com/errata/RHSA-2025:22683
• https://access.redhat.com/errata/RHSA-2025:22684
• https://access.redhat.com/errata/RHSA-2025:23528
• https://access.redhat.com/errata/RHSA-2025:23529
• https://access.redhat.com/errata/RHSA-2025:23542
• https://access.redhat.com/errata/RHSA-2026:0627
• https://access.redhat.com/errata/RHSA-2026:0718
• https://access.redhat.com/errata/RHSA-2026:0722
• https://access.redhat.com/errata/RHSA-2026:0737
• https://access.redhat.com/errata/RHSA-2026:2572
• https://access.redhat.com/errata/RHSA-2026:5633
• https://access.redhat.com/security/cve/CVE-2025-7195
• https://bugzilla.redhat.com/show_bug.cgi?id=2376300