ingress-nginx path sanitization can be bypassed

🗓️ 25 Oct 2023 15:48:08Reported by Kubernetes Security Response CommitteeType

Ingress-nginx path sanitization bypass can expose credentials; fix via pathType validation and admission webhook.

Reporter	Title	Published	Views	Family All 23
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities (CVE-2023-5043, CVE-2023-5044, CVE-2022-4886)	10 Nov 202309:46	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Kubernetes ingress-nginx	19 Mar 202423:36	–	ibm
BDU FSTEC	The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx allows a hacker to execute arbitrary code or increase their privileges.	1 Nov 202300:00	–	bdu_fstec
Circl	CVE-2022-4886	26 Oct 202300:39	–	circl
CNNVD	Ingress-nginx 安全漏洞	12 Apr 202200:00	–	cnnvd
CVE	CVE-2022-4886	25 Oct 202319:18	–	cve
Cvelist	CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive	25 Oct 202319:18	–	cvelist
EUVD	EUVD-2023-2743	3 Oct 202520:07	–	euvd
Github Security Blog	Ingress-nginx path sanitization can be bypassed	25 Oct 202321:30	–	github
NVD	CVE-2022-4886	25 Oct 202320:15	–	nvd