CVE-2021-25742 - log back

CVE-2021-25742 edited at 21 Oct 2021 19:07:37
Severity
- Unknown
+ High
Remote
- Unknown
+ Remote
Type
- Unknown
+ Information disclosure
Description
+ A security issue was discovered in ingress-nginx before versions 1.0.1 and 0.49.1 where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.
+
+ This issue cannot be fixed solely by upgrading ingress-nginx. To mitigate, set allow-snippet-annotations to false in your ingress-nginx ConfigMap based on how you deploy ingress-nginx, see the references for more information.
References
+ https://github.com/kubernetes/ingress-nginx/issues/7837
+ https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#allow-snippet-annotations
+ https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/
+ https://github.com/kubernetes/ingress-nginx/pull/7670
+ https://github.com/kubernetes/ingress-nginx/commit/4fc57dcc4969cd907c6eeadffbba2d14949db39e
Notes
CVE-2021-25742 created at 21 Oct 2021 19:02:52