K01051452 : NGINX Ingress Controller vulnerability CVE-2021-23055

Security Advisory Description

The command line restriction that controls snippet use with NGINX Ingress Controller does not apply to Ingress objects. (CVE-2021-23055)

Impact

An attacker with privileges to deploy Ingress resources can inject configuration snippets that may allow them to gain access to secrets using the Ingress service account permissions.

In NGINX Ingress Controller versions prior to 2.0.3 and 1.12.3, Ingress resources can be configured without setting the** -enable-snippets** command line argument.

Beginning in NGINX Ingress Controller versions 2.0.3 and 1.12.3, snippet notations are handled only when the snippets capability is explicitly enabled by the Ingress operator using the** -enable-snippets** command line argument.

For more information about using snippets in your NGINX configuration, refer to Advanced Configuration with Snippets.