| Severity |
|
| Remote |
|
| Type |
| - |
Unknown |
| + |
Information disclosure |
|
| Description |
| + |
A security issue was discovered in ingress-nginx before versions 1.0.1 and 0.49.1 where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster. |
| + |
|
| + |
This issue cannot be fixed solely by upgrading ingress-nginx. To mitigate, set allow-snippet-annotations to false in your ingress-nginx ConfigMap based on how you deploy ingress-nginx, see the references for more information. |
|
| References |
| + |
https://github.com/kubernetes/ingress-nginx/issues/7837 |
| + |
https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#allow-snippet-annotations |
| + |
https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/ |
| + |
https://github.com/kubernetes/ingress-nginx/pull/7670 |
| + |
https://github.com/kubernetes/ingress-nginx/commit/4fc57dcc4969cd907c6eeadffbba2d14949db39e |
|
| Notes |
|