diff --git a/advisories/github-reviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json b/advisories/github-reviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json new file mode 100644 index 00000000000..7c3077af98f --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json @@ -0,0 +1,93 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-242m-6h72-7hgp", + "modified": "2025-03-25T15:10:08Z", + "published": "2025-03-25T00:30:26Z", + "aliases": [ + "CVE-2025-24513" + ], + "summary": "ingress-nginx controller - auth secret file path traversal vulnerability", + "details": "A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/ingress-nginx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/ingress-nginx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.12.0-beta.0" + }, + { + "fixed": "1.12.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24513" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/issues/131005" + }, + { + "type": "PACKAGE", + "url": "https://github.com/kubernetes/ingress-nginx" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20", + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-25T15:10:08Z", + "nvd_published_at": "2025-03-25T00:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json b/advisories/github-reviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json new file mode 100644 index 00000000000..44c3dce0ab8 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json @@ -0,0 +1,93 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fwwp-xcxw-39vq", + "modified": "2025-03-25T15:10:02Z", + "published": "2025-03-25T00:30:26Z", + "aliases": [ + "CVE-2025-24514" + ], + "summary": "ingress-nginx controller - configuration injection via unsanitized auth-url annotation", + "details": "A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/ingress-nginx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/ingress-nginx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.12.0-beta.0" + }, + { + "fixed": "1.12.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24514" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/issues/131006" + }, + { + "type": "PACKAGE", + "url": "https://github.com/kubernetes/ingress-nginx" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-15", + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-25T15:10:02Z", + "nvd_published_at": "2025-03-25T00:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json b/advisories/github-reviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json new file mode 100644 index 00000000000..d4bd7697418 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mgvx-rpfc-9mpv", + "modified": "2025-03-25T15:10:14Z", + "published": "2025-03-25T00:30:26Z", + "aliases": [ + "CVE-2025-1974" + ], + "summary": "ingress-nginx admission controller RCE escalation", + "details": "A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/ingress-nginx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/ingress-nginx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.12.0-beta.0" + }, + { + "fixed": "1.12.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1974" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/issues/131009" + }, + { + "type": "PACKAGE", + "url": "https://github.com/kubernetes/ingress-nginx" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-653" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-03-25T15:10:14Z", + "nvd_published_at": "2025-03-25T00:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json b/advisories/unreviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json deleted file mode 100644 index 1324433a738..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-242m-6h72-7hgp", - "modified": "2025-03-25T00:30:26Z", - "published": "2025-03-25T00:30:26Z", - "aliases": [ - "CVE-2025-24513" - ], - "details": "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24513" - }, - { - "type": "WEB", - "url": "https://github.com/kubernetes/kubernetes/issues/131005" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-25T00:15:14Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json b/advisories/unreviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json deleted file mode 100644 index 89295edac97..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fwwp-xcxw-39vq", - "modified": "2025-03-25T00:30:26Z", - "published": "2025-03-25T00:30:26Z", - "aliases": [ - "CVE-2025-24514" - ], - "details": "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24514" - }, - { - "type": "WEB", - "url": "https://github.com/kubernetes/kubernetes/issues/131006" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-25T00:15:15Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json b/advisories/unreviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json deleted file mode 100644 index 2bac2d5d264..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-mgvx-rpfc-9mpv", - "modified": "2025-03-25T00:30:26Z", - "published": "2025-03-25T00:30:26Z", - "aliases": [ - "CVE-2025-1974" - ], - "details": "A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1974" - }, - { - "type": "WEB", - "url": "https://https://github.com/kubernetes/kubernetes/issues/131009" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-653" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-25T00:15:14Z" - } -} \ No newline at end of file