Publish Advisories

GHSA-27hp-xhwr-wr2m
GHSA-mg7w-c9x2-xh7r

advisories/github-reviewed/2024/12/GHSA-27hp-xhwr-wr2m/GHSA-27hp-xhwr-wr2m.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-27hp-xhwr-wr2m",
-  "modified": "2024-12-20T19:50:45Z",
+  "modified": "2025-01-03T16:10:58Z",
   "published": "2024-12-20T18:31:32Z",
   "aliases": [
     "CVE-2024-56337"
@@ -86,6 +86,10 @@
       "type": "WEB",
       "url": "https://lists.apache.org/thread/b2b9qrgjrz1kvo4ym8y2wkfdvwoq6qbp"
     },
+    {
+      "type": "WEB",
+      "url": "https://security.netapp.com/advisory/ntap-20250103-0002"
+    },
     {
       "type": "WEB",
       "url": "https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.34"

advisories/github-reviewed/2025/01/GHSA-mg7w-c9x2-xh7r/GHSA-mg7w-c9x2-xh7r.json

@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-mg7w-c9x2-xh7r",
+  "modified": "2025-01-03T16:12:03Z",
+  "published": "2025-01-03T16:12:03Z",
+  "aliases": [
+    "CVE-2024-56513"
+  ],
+  "summary": "Karmada PULL Mode Cluster Privilege Escalation",
+  "details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n\nThe [PULL](https://karmada.io/docs/next/userguide/clustermanager/cluster-registration#pull-mode) mode clusters registered with the `karmadactl register` command have excessive privileges to access control plane resources. By abusing these permissions, an attacker able to authenticate as the karmada-agent to a karmada cluster would be able to obtain administrative privileges over the entire federation system including all registered member clusters.\n\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nSince Karmada v1.12.0, command `karmadactl register` restricts the access permissions of pull mode member clusters to control plane resources. This way, an attacker able to authenticate as the karmada-agent cannot control other member clusters in Karmada.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nRestricts the access permissions of pull mode member clusters to control plane resources according to [Karmada Component Permissions Docs](https://karmada.io/docs/administrator/security/component-permission).\n### References\n_Are there any links users can visit to find out more?_\n 1. Enhancements made from the Karmada community: https://github.com/karmada-io/karmada/pull/5793\n 2. Karmada Component Permissions: https://karmada.io/docs/administrator/security/component-permission\n",
+  "severity": [
+    {
+      "type": "CVSS_V4",
+      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/karmada-io/karmada"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "1.12.0"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/karmada-io/karmada/security/advisories/GHSA-mg7w-c9x2-xh7r"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/karmada-io/karmada/pull/5793"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/karmada-io/karmada/commit/2c82055c4c7f469411b1ba48c4dba4841df04831"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/karmada-io/karmada"
+    },
+    {
+      "type": "WEB",
+      "url": "https://karmada.io/docs/administrator/security/component-permission"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-266"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-01-03T16:12:03Z",
+    "nvd_published_at": null
+  }
+}