From 890bdfbc2ccc1a9c1c54fe04980f7552714d08d0 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 25 Mar 2025 15:11:55 +0000 Subject: [PATCH] Publish Advisories GHSA-242m-6h72-7hgp GHSA-fwwp-xcxw-39vq GHSA-mgvx-rpfc-9mpv GHSA-242m-6h72-7hgp GHSA-fwwp-xcxw-39vq GHSA-mgvx-rpfc-9mpv --- .../GHSA-242m-6h72-7hgp.json | 93 +++++++++++++++++++ .../GHSA-fwwp-xcxw-39vq.json | 93 +++++++++++++++++++ .../GHSA-mgvx-rpfc-9mpv.json | 92 ++++++++++++++++++ .../GHSA-242m-6h72-7hgp.json | 36 ------- .../GHSA-fwwp-xcxw-39vq.json | 36 ------- .../GHSA-mgvx-rpfc-9mpv.json | 36 ------- 6 files changed, 278 insertions(+), 108 deletions(-) create mode 100644 advisories/github-reviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json create mode 100644 advisories/github-reviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json create mode 100644 advisories/github-reviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json delete mode 100644 advisories/unreviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json delete mode 100644 advisories/unreviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json delete mode 100644 advisories/unreviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json diff --git a/advisories/github-reviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json b/advisories/github-reviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json new file mode 100644 index 00000000000..7c3077af98f --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json @@ -0,0 +1,93 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-242m-6h72-7hgp", + "modified": "2025-03-25T15:10:08Z", + "published": "2025-03-25T00:30:26Z", + "aliases": [ + "CVE-2025-24513" + ], + "summary": "ingress-nginx controller - auth secret file path traversal vulnerability", + "details": "A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/ingress-nginx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/ingress-nginx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.12.0-beta.0" + }, + { + "fixed": "1.12.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24513" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/issues/131005" + }, + { + "type": "PACKAGE", + "url": "https://github.com/kubernetes/ingress-nginx" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20", + "CWE-22" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-03-25T15:10:08Z", + "nvd_published_at": "2025-03-25T00:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json b/advisories/github-reviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json new file mode 100644 index 00000000000..44c3dce0ab8 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json @@ -0,0 +1,93 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-fwwp-xcxw-39vq", + "modified": "2025-03-25T15:10:02Z", + "published": "2025-03-25T00:30:26Z", + "aliases": [ + "CVE-2025-24514" + ], + "summary": "ingress-nginx controller - configuration injection via unsanitized auth-url annotation", + "details": "A security issue was discovered in [ingress-nginx](https://github.com/kubernetes/ingress-nginx) where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/ingress-nginx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/ingress-nginx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.12.0-beta.0" + }, + { + "fixed": "1.12.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24514" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/issues/131006" + }, + { + "type": "PACKAGE", + "url": "https://github.com/kubernetes/ingress-nginx" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-15", + "CWE-20" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-03-25T15:10:02Z", + "nvd_published_at": "2025-03-25T00:15:15Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json b/advisories/github-reviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json new file mode 100644 index 00000000000..d4bd7697418 --- /dev/null +++ b/advisories/github-reviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json @@ -0,0 +1,92 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mgvx-rpfc-9mpv", + "modified": "2025-03-25T15:10:14Z", + "published": "2025-03-25T00:30:26Z", + "aliases": [ + "CVE-2025-1974" + ], + "summary": "ingress-nginx admission controller RCE escalation", + "details": "A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/ingress-nginx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.11.5" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Go", + "name": "k8s.io/ingress-nginx" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.12.0-beta.0" + }, + { + "fixed": "1.12.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1974" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/kubernetes/issues/131009" + }, + { + "type": "PACKAGE", + "url": "https://github.com/kubernetes/ingress-nginx" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.11.5" + }, + { + "type": "WEB", + "url": "https://github.com/kubernetes/ingress-nginx/releases/tag/controller-v1.12.1" + }, + { + "type": "WEB", + "url": "https://groups.google.com/g/kubernetes-security-announce/c/2qa9DFtN0cQ" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-653" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-03-25T15:10:14Z", + "nvd_published_at": "2025-03-25T00:15:14Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json b/advisories/unreviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json deleted file mode 100644 index 1324433a738..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-242m-6h72-7hgp", - "modified": "2025-03-25T00:30:26Z", - "published": "2025-03-25T00:30:26Z", - "aliases": [ - "CVE-2025-24513" - ], - "details": "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24513" - }, - { - "type": "WEB", - "url": "https://github.com/kubernetes/kubernetes/issues/131005" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-25T00:15:14Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json b/advisories/unreviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json deleted file mode 100644 index 89295edac97..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-fwwp-xcxw-39vq/GHSA-fwwp-xcxw-39vq.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-fwwp-xcxw-39vq", - "modified": "2025-03-25T00:30:26Z", - "published": "2025-03-25T00:30:26Z", - "aliases": [ - "CVE-2025-24514" - ], - "details": "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24514" - }, - { - "type": "WEB", - "url": "https://github.com/kubernetes/kubernetes/issues/131006" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-20" - ], - "severity": "HIGH", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-25T00:15:15Z" - } -} \ No newline at end of file diff --git a/advisories/unreviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json b/advisories/unreviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json deleted file mode 100644 index 2bac2d5d264..00000000000 --- a/advisories/unreviewed/2025/03/GHSA-mgvx-rpfc-9mpv/GHSA-mgvx-rpfc-9mpv.json +++ /dev/null @@ -1,36 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-mgvx-rpfc-9mpv", - "modified": "2025-03-25T00:30:26Z", - "published": "2025-03-25T00:30:26Z", - "aliases": [ - "CVE-2025-1974" - ], - "details": "A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)", - "severity": [ - { - "type": "CVSS_V3", - "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" - } - ], - "affected": [], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1974" - }, - { - "type": "WEB", - "url": "https://https://github.com/kubernetes/kubernetes/issues/131009" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-653" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2025-03-25T00:15:14Z" - } -} \ No newline at end of file