Improper path handling in kustomization files allows path traversal
概要
Improper path handling in kustomization files allows path traversal
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate kustomization.yaml files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com/fluxcd/kustomize-controller
- web github.com
- web github.com