PT-2024-5586

Name of the Vulnerable Software and Affected Versions: ingress-nginx versions prior to 1.12 Description: A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects can bypass annotation validation to inject arbitrary commands and obtain the credentia...

GO-2024-2428 Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation in k8s.io/ingress-nginx

Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation in k8s.io/ingress-nginx. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive repor...

CVE-2024-32760 vulnerabilities

Vulnerabilities for packages: nginx-mainline, nginx-stable...

CVE-2024-34161 vulnerabilities

Vulnerabilities for packages: nginx-mainline, nginx-stable...

CVE-2024-35200 vulnerabilities

Vulnerabilities for packages: nginx-mainline, nginx-stable...

CVE-2024-31079 vulnerabilities

Vulnerabilities for packages: nginx-mainline, nginx-stable...

GHSA-C5PJ-MQFH-RVC3 vulnerabilities

Vulnerabilities for packages: docker...

CVE-2024-3154 vulnerabilities

Vulnerabilities for packages: opentelemetry-collector-contrib-fips, cadvisor-fips, cadvisor, kubernetes, neuvector-scanner, wolfictl, grype, buildah, ctop, opentelemetry-collector-contrib...

Exploit for Improper Input Validation in Kubernetes Ingress-Nginx

CVE-2023-5044 Poc for CVE 2023 5044 Prerequisites Kind: v0...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Kubernetes ingress-nginx

Summary Multiple vulnerabilities in Kubernetes ingress-nginx used by IBM InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2022-4886 DESCRIPTION: Kubernetes could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw with path...

BIT-NGINX-INGRESS-CONTROLLER-2020-8553 Kubernetes ingress-nginx Compromise of auth via subset/superset namespace names

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace ...

BIT-NGINX-INGRESS-CONTROLLER-2021-25745 Ingress-nginx path can be pointed to service account token file

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of the ingress-nginx controller. In the default...

BIT-NGINX-INGRESS-CONTROLLER-2021-25746 Ingress-nginx directive injection via annotations

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use .metadata.annotations in an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of the ingress-nginx controller. In the default configuration, that...

BIT-NGINX-INGRESS-CONTROLLER-2021-25748 Ingress-nginx `path` sanitization can be bypassed with newline character

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of...

BIT-NGINX-INGRESS-CONTROLLER-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive

Ingress-nginx path sanitization can be bypassed with logformat directive...

CVE-2024-24786 vulnerabilities

Vulnerabilities for packages: spire-server-fips, scorecard, vertical-pod-autoscaler, terraform-provider-sendgrid, gitness, minio, kots, sops, ctop, rabbitmq-cluster-operator, buildkitd, helm-operator-fips, kubernetes-dns-node-cache, prometheus-alertmanager-fips, temporal-fips,...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: kaniko, kubernetes, wolfictl, nerdctl, kubescape, syft, cadvisor, podman, grype, kots, docker, zarf, runc, k9s, newrelic-infrastructure-agent, ctop, zot, skopeo, buildkitd, k3s, trivy, skaffold, k3d...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: nerdctl, wolfictl, grype, buildkitd, kots, kubescape, skaffold, zarf, trivy, cadvisor, runc, k9s, skopeo, docker, podman, newrelic-infrastructure-agent, kubernetes, k3s, kaniko, zot, k3d, ctop, syft...

Exploit for Improper Input Validation in Kubernetes Ingress-Nginx

CVE-2023-5044 Ingress Nginx Exploit Proof-Of-Concept This is...

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx allows a hacker to execute arbitrary code or increase their privileges.

The vulnerability of the ingress controller in the Kubernetes cluster ingress-nginx is related to errors in processing incoming data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or increase their privileges using the logformat directive...