GitHub Advisoryadvisory · Go

GHSA-9wh7-397j-722m Ironic and ironic-inspector may expose as ConfigMaps

MEDIUM Published 2023-04-26 Modified 2023-04-26 Official page ↗
Aliases
CVE-2023-30841
Ecosystem
Go
Packages
github.com/metal3-io/baremetal-operator
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Weaknesses
CWE-200, CWE-319
Reviewed
2023-04-26

Affected packages

• Go github.com/metal3-io/baremetal-operator: < 0.3.0 → fixed in 0.3.0

Description

Impact Ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. Patches This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. Workarounds User may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241

Related

Alias · CVE (1)

  • CVE-2023-30841 Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-319 Cleartext Transmission of Sensitive Information weakness

References