netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-242m-6h72-7hgp
GHSA-fwwp-xcxw-39vq
GHSA-mgvx-rpfc-9mpv
GHSA-242m-6h72-7hgp
GHSA-fwwp-xcxw-39vq
GHSA-mgvx-rpfc-9mpv
This commit is contained in:
advisory-database[bot]
2025-03-25 15:11:55 +00:00
parent 1d2372f2bd
commit 890bdfbc2c
6 changed files with 278 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json
+93
View File
@@ -0,0 +1,93 @@
{
"schema_version": "1.4.0",
"id": "GHSA-242m-6h72-7hgp",
"modified": "2025-03-25T15:10:08Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-24513"
],
"summary": "ingress-nginx controller - auth secret file path traversal vulnerability",
"details": "A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/ingress-nginx"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/ingress-nginx"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.12.0-beta.0"
},
{
"fixed": "1.12.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24513"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/131005"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubernetes/ingress-nginx"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-22"
],
"severity": "MODERATE",
"github_reviewed": true,
"github_reviewed_at": "2025-03-25T15:10:08Z",
"nvd_published_at": "2025-03-25T00:15:14Z"
}
}
advisories/github-reviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json
+93
View File
@@ -0,0 +1,93 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fwwp-xcxw-39vq",
"modified": "2025-03-25T15:10:02Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-24514"
],
"summary": "ingress-nginx controller - configuration injection via unsanitized auth-url annotation",
"details": "A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/ingress-nginx"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/ingress-nginx"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.12.0-beta.0"
},
{
"fixed": "1.12.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24514"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/131006"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubernetes/ingress-nginx"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ"
}
],
"database_specific": {
"cwe_ids": [
"CWE-15",
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": true,
"github_reviewed_at": "2025-03-25T15:10:02Z",
"nvd_published_at": "2025-03-25T00:15:15Z"
}
}
advisories/github-reviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json
+92
View File
@@ -0,0 +1,92 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mgvx-rpfc-9mpv",
"modified": "2025-03-25T15:10:14Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-1974"
],
"summary": "ingress-nginx admission controller RCE escalation",
"details": "A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/ingress-nginx"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.11.5"
}
]
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "k8s.io/ingress-nginx"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "1.12.0-beta.0"
},
{
"fixed": "1.12.1"
}
]
}
]
}
],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1974"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/131009"
},
{
"type": "PACKAGE",
"url": "https://github.com/kubernetes/ingress-nginx"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ"
}
],
"database_specific": {
"cwe_ids": [
"CWE-653"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2025-03-25T15:10:14Z",
"nvd_published_at": "2025-03-25T00:15:14Z"
}
}
advisories/unreviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-242m-6h72-7hgp",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-24513"
],
"details": "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24513"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/131005"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T00:15:14Z"
}
}
advisories/unreviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-fwwp-xcxw-39vq",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-24514"
],
"details": "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24514"
},
{
"type": "WEB",
"url": "https://github.com/kubernetes/kubernetes/issues/131006"
}
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"severity": "HIGH",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T00:15:15Z"
}
}
advisories/unreviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json
-36
View File
@@ -1,36 +0,0 @@
{
"schema_version": "1.4.0",
"id": "GHSA-mgvx-rpfc-9mpv",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-25T00:30:26Z",
"aliases": [
"CVE-2025-1974"
],
"details": "A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [],
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1974"
},
{
"type": "WEB",
"url": "https://https://github.com/kubernetes/kubernetes/issues/131009"
}
],
"database_specific": {
"cwe_ids": [
"CWE-653"
],
"severity": "CRITICAL",
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-25T00:15:14Z"
}
}