GitHub Advisoryadvisory · Go
GHSA-5g3x-8g2v-r8x8 Volcano has insecure permissions
CRITICAL
Official page ↗
- Aliases
- CVE-2024-36533
- Ecosystem
- Go
- Packages
- github.com/volcano-sh/volcano, volcano.sh/volcano
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-1259
- Reviewed
- 2024-08-02
Affected packages
• Go github.com/volcano-sh/volcano: < 1.10.0-alpha.0 → fixed in 1.10.0-alpha.0
• Go volcano.sh/volcano: < 1.10.0-alpha.0 → fixed in 1.10.0-alpha.0
Description
Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token.
Related
Alias · CVE (1)
- CVE-2024-36533 Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's… vulnerability
Weakness · CWE (1)
- CWE-1259 Improper Restriction of Security Token Assignment weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-36533 advisory
- https://github.com/volcano-sh/volcano/issues/3446 web
- https://github.com/volcano-sh/volcano/pull/3449 web
- https://github.com/volcano-sh/volcano/commit/55963f71c76cb85cea1cdb9582ea7d58cfbedcf8 web
- https://gist.github.com/HouqiyuA/a0e05a26ecc80bd970ac4649faecc930 web
- https://github.com/volcano-sh/volcano package
- https://pkg.go.dev/vuln/GO-2024-3034 web