GitHub Advisoryadvisory · Go

GHSA-hhpm-74pm-hf35 ingress-nginx component for Kubernetes allows file overwrite

MEDIUM Published 2022-05-24 Modified 2023-08-22 Official page ↗
Aliases
CVE-2020-8553
Ecosystem
Go
Packages
k8s.io/ingress-nginx
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-610, CWE-73
Reviewed
2023-07-13

Affected packages

• Go k8s.io/ingress-nginx: < 0.28.0 → fixed in 0.28.0

Description

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.

Related

Alias · CVE (1)

  • CVE-2020-8553 The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create… vulnerability

Weakness · CWE (2)

  • CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness
  • CWE-73 External Control of File Name or Path weakness

References