GitHub Advisoryadvisory · Go

GHSA-849r-8wvp-4wwg Permissions bypass in KubeVirt

MEDIUM Published 2021-06-01 Modified 2024-04-24 Official page ↗
Aliases
CVE-2020-1701
Ecosystem
Go
Packages
kubevirt.io/kubevirt
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-732
Reviewed
2024-04-24

Affected packages

• Go kubevirt.io/kubevirt: < 0.26.0 → fixed in 0.26.0

Description

A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret.

Related

Alias · CVE (1)

  • CVE-2020-1701 A flaw was found in the KubeVirt main virt-handler versions before 0.26.0 regarding the access permissions of virt-handler. vulnerability

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References