CVE-2023-30841 Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps

2023-04-2618:24:04

CWE-200

GitHub_M

www.cve.org

cve-2023-30841

ironic

ironic-inspector

baremetal operator

kubernetes

configmaps

etcd

secrets

patch

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

AI Score

6.1

Confidence

High

EPSS

Percentile

9.0%

JSON

Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included deploy.sh store their .htpasswd files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster’s Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.

CNA Affected

[
  {
    "vendor": "metal3-io",
    "product": "baremetal-operator",
    "versions": [
      {
        "version": "< 0.3.0",
        "status": "affected"
      }
    ]
  }
]