CVEvulnerability

CVE-2023-5044

8.8 HIGH Published 2023-10-25 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2023-10-25
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.6 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVSS 3.1 ([email protected]): 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-20, CWE-94

Description

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation.

Affected configurations

• kubernetes ingress-nginx (< 1.9.0)

Related

Weakness · CWE (2)

CWE-20 Improper Input Validation weakness
CWE-94 Improper Control of Generation of Code weakness

References

http://www.openwall.com/lists/oss-security/2023/10/25/3 Mailing List, Third Party Advisory
https://github.com/kubernetes/ingress-nginx/issues/10572 Issue Tracking, Mitigation, Vendor Advisory
https://groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0 Mailing List, Mitigation
https://security.netapp.com/advisory/ntap-20240307-0012/ security.netapp.com
http://www.openwall.com/lists/oss-security/2023/10/25/3 Mailing List, Third Party Advisory
https://github.com/kubernetes/ingress-nginx/issues/10572 Issue Tracking, Mitigation, Vendor Advisory
https://groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0 Mailing List, Mitigation
https://security.netapp.com/advisory/ntap-20240307-0012/ security.netapp.com