CVE-2023-5043 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

CVE-2023-5043 vulnerabilities

Vulnerabilities for packages: ingress-nginx-controller...

CVE-2023-5044

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation...

CVE-2022-4886

Ingress-nginx path sanitization can be bypassed with logformat directive...

Code injection

Ingress-nginx path sanitization can be bypassed with logformat directive...

Design/Logic Flaw

Ingress nginx annotation injection causes arbitrary command execution...

Code injection

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation...

CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation...

CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation...

CVE-2023-5044 Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation...

CVE-2023-5044

CVE-2023-5044 : Code injection via the nginx.ingress.kubernetes.io/permanent-redirect annotation in Kubernetes ingress-nginx. The root cause is improper input validation of the permanent-redirect annotation, enabling an attacker to inject executable content. Public material confirms a PoC/exploit...

CVE-2023-5043 Ingress nginx annotation injection causes arbitrary command execution

Ingress nginx annotation injection causes arbitrary command execution...

CVE-2023-5043

CVE-2023-5043 affects Kubernetes ingress-nginx where the nginx.ingress.kubernetes.io/configuration-snippet annotation injection allows a remote authenticated attacker to execute arbitrary commands on the system due to improper input validation. IBM’s bulletin associates this CVE with IBM Cloud Ku...

CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive

Ingress-nginx path sanitization can be bypassed with logformat directive...

CVE-2022-4886

CVE-2022-4886 is an Ingress-Nginx vulnerability where path sanitization can be bypassed via the log_format directive. IBM and OSV entries describe an impact: a remote authenticated attacker could obtain credentials information from Kubernetes Ingress Controller (ALB) deployments affected by this ...

CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive

Ingress-nginx path sanitization can be bypassed with logformat directive...

CVE-2022-4886 Ingress-nginx `path` sanitization can be bypassed with `log_format` directive

Ingress-nginx path sanitization can be bypassed with logformat directive...

Moderate: Red Hat Security Advisory: nginx:1.22 security update

An update for the nginx:1.22 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

Issue Details A security issue was identified in ingress-nginx where the nginx.ingress.kubernetes.io/permanent-redirect annotation on an Ingress object in the networking.k8s.io or extensions API group can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx...

ingress-nginx path sanitization can be bypassed

Issue Details A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use directives to bypass the sanitization of the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentia...