Improper path handling in kustomization files allows path traversal
Résumé
Improper path handling in kustomization files allows path traversal
Description d'origine
La description telle que publiée par la source (souvent en anglais).
Flux is an open and extensible continuous delivery solution for Kubernetes. Path Traversal in the kustomize-controller via a malicious kustomization.yaml allows an attacker to expose sensitive data from the controller’s pod filesystem and possibly privilege escalation in multi-tenancy deployments. Workarounds include automated tooling in the user's CI/CD pipeline to validate kustomization.yaml files conform with specific policies. This vulnerability is fixed in kustomize-controller v0.24.0 and included in flux2 v0.29.0.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com/fluxcd/kustomize-controller
- web github.com
- web github.com