GitHub Advisoryadvisory · Go

GHSA-wx8q-4gm9-rj2g Fluid vulnerable to OS Command Injection for Fluid Users with JuicefsRuntime

MEDIUM Published 2024-03-15 Modified 2025-04-09 Official page ↗
Aliases
CVE-2023-51699
Ecosystem
Go
Packages
github.com/fluid-cloudnative/fluid
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-78
Reviewed
2024-03-15

Affected packages

• Go github.com/fluid-cloudnative/fluid: < 0.9.3 → fixed in 0.9.3

Description

Impact OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to unauthorized access, modification or deletion of data. Patches For users who're using version < 0.9.3 with JuicefsRuntime， upgrade to v0.9.3. References _Are there any links users can visit to find out more?_ Credits Special thanks to the discovers of this issue: Xiaozheng Zhang [email protected]

Related

Alias · CVE (1)

  • CVE-2023-51699 Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References