GHSA-242m-6h72-7hgp

Source

https://github.com/advisories/GHSA-242m-6h72-7hgp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/03/GHSA-242m-6h72-7hgp/GHSA-242m-6h72-7hgp.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-242m-6h72-7hgp

Aliases

Related

Published

2025-03-25T00:30:26Z

Modified

2025-03-26T08:26:56.830890Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator

Summary

ingress-nginx controller - auth secret file path traversal vulnerability

Details

A security issue was discovered in ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.

Database specific

{
    "nvd_published_at": "2025-03-25T00:15:14Z",
    "cwe_ids": [
        "CWE-20",
        "CWE-22"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2025-03-25T15:10:08Z"
}

References

Affected packages

Go / k8s.io/ingress-nginx

Package

Name: k8s.io/ingress-nginx; View open source insights on deps.dev
Purl: pkg:golang/k8s.io/ingress-nginx

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.11.5