CyberzSOC

Applicability
← Back to CVE-2024-9486

CVE-2024-9486

Kubernetes

Every applicability statement published about this vulnerability, kept as each source wrote it rather than merged into one verdict. Where sources disagree, both positions are shown.

Does it affect your version?

A statement that names no version covers the whole product, which is not the same as your version falling inside a range. Orderings marked best effort come from schemes with no published comparison algorithm; exact ones follow a published specification.

What each source says

Red Hat CSAF/VEX
precedence 100 · revised 2025-11-21
1 not affected
OSV.dev (incl. GHSA)
precedence 80 · revised 2026-09-13
3 affected 3 fixed
CVE List v5 (CNA container)
precedence 60 · revised 2024-10-16
1 affected 1 not affected
CVE List v5 (ADP/Vulnrichment)
precedence 55 · revised 2024-10-16
1 affected

Precedence decides which claim wins when two sources describe the same product over the same version range. It is a property of the source, not of the claim, and changing it re-ranks the data without re-reading a single document.

Statements (8)

Product Status Versions Remediation Source
red_hat_products Red Hat · All currently supported Red Hat products not affected vulnerable code not present no version stated not applicable csaf_redhat
github.com/kubernetes-sigs/image-builder affected < 0.1.38 vendor fix → 0.1.38 osv GO-2024-3203
https://github.com/kubernetes-sigs/image-builder affected < 53172d2fd1c55d6247d2d9604cec974b03150ca3 vendor fix → 53172d2fd1c55d6247d2d9604cec974b03150ca3 osv
github.com/kubernetes-sigs/image-builder fixed 0.1.38 vendor fix → 0.1.38 osv GO-2024-3203
https://github.com/kubernetes-sigs/image-builder fixed 53172d2fd1c55d6247d2d9604cec974b03150ca3 vendor fix → 53172d2fd1c55d6247d2d9604cec974b03150ca3 osv
Kubernetes/Image Builder Kubernetes · Image Builder affected <= 0.1.37 none available cve_cna
Kubernetes/Image Builder Kubernetes · Image Builder not affected 0.1.38 not applicable cve_cna
kubernetes/image_builder kubernetes · image_builder affected < 0.1.38 none available cve_adp

A claim with no version range is shown as written rather than expanded: a government catalog naming only a vendor and product is a real statement at zero granularity, and inventing bounds for it would put precision in the record that the source never offered.