CVE-2022-23506

CVE-2022-23506 affects Spinnaker’s Rosco microservice. Prior to versions 1.29.2, 1.28.4, and 1.27.3, Rosco did not properly mask secrets generated during Packer builds, which could expose AWS credentials in log files. The issue is mitigated in 1.29.2, 1.28.4, and 1.27.3+ fixes. A workaround recom...

CVE-2022-23506 Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds

Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine images. Rosco prior to versions 1.29.2, 1.28.4, and 1.27.3 does not property mask secrets generated via packer builds. This can lead to exposur...

bookings.spinnakertower.co.uk Cross Site Scripting vulnerability OBB-3127334

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Spinnaker 日志信息泄露漏洞

Spinnaker is a continuous delivery platform. It is used to release software changes with high speed and confidence. A log information disclosure vulnerability exists in Spinnaker versions prior to 1.29.2, prior to 1.28.4, and prior to 1.27.3, which stems from not preserving a masked secret...

PT-2023-12722 · Spinnaker +2 · Spinnaker +2

Name of the Vulnerable Software and Affected Versions: Spinnaker's Rosco microservice versions prior to 1.29.2, 1.28.4, and 1.27.3 Description: Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine...

Spinnaker Path Traversal Vulnerability

Spinnaker is a continuous delivery platform. Used to release software changes with high speed and confidence. Spinnaker suffers from a path traversal vulnerability that arises from a networked system or product that fails to properly filter for specific elements in a resource or file path. An...

Spinnaker Access Control Error Vulnerability

Spinnaker is a continuous delivery platform. Used to release software changes with high speed and confidence. Spinnaker has a security vulnerability that stems from the presence of inappropriate privileges in the software that allow for pipeline creation and execution. This allows an arbitrary us...

CVE-2021-43832

Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup...

CVE-2021-43832

Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup...

Design/Logic Flaw

Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup...

CVE-2021-43832 Improper Access Control in spinnaker

Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup...

CVE-2021-43832

CVE-2021-43832 applies to Spinnaker, where improper permissions allow an arbitrary user with gate-endpoint access to create and execute pipelines without authentication. If RBAC is not configured across all accounts/applications, this enables remote execution and deploying resources on any accoun...

CVE-2021-43832 Improper Access Control in spinnaker

Spinnaker is an open source, multi-cloud continuous delivery platform. Spinnaker has improper permissions allowing pipeline creation & execution. This lets an arbitrary user with access to the gate endpoint to create a pipeline and execute it without authentication. If users haven't setup...

CVE-2021-39143

Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for deployments. This uses a utility to extract files locally for deployment without validating the paths in that deployment don't override system...

CVE-2021-39143

Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for deployments. This uses a utility to extract files locally for deployment without validating the paths in that deployment don't override system...

Path traversal

Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for deployments. This uses a utility to extract files locally for deployment without validating the paths in that deployment don't override system...

CVE-2021-39143

Spinnaker path traversal (CVE-2021-39143) arises from TAR extraction in AppEngine deployments, where files are deployed without validating paths, allowing a container to overwrite system files and potentially enable MITM via library wrapper/file injection. Affected component: io.spinnaker.clouddr...

CVE-2021-39143 Path Traversal in spinnaker

Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for deployments. This uses a utility to extract files locally for deployment without validating the paths in that deployment don't override system...

Spinnaker 访问控制错误漏洞

Spinnaker is a continuous delivery platform. Used to release software changes with high speed and confidence. Spinnaker has a security vulnerability that stems from the presence of inappropriate privileges in the software that allow for pipeline creation and execution. This allows an arbitrary us...

Spinnaker 路径遍历漏洞

Spinnaker is a continuous delivery platform. Used to release software changes with high speed and confidence. Spinnaker suffers from a path traversal vulnerability that arises from a networked system or product that fails to properly filter for specific elements in a resource or file path. An...