Lucene search
Veracode Vulnerability DatabaseVERACODE:38207HistoryNov 23, 2022 - 10:47 a.m.
Information Disclosure
2022-11-2310:47:28
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
13
information disclosure
vulnerability
knative/func
github
unauthorized access
third-party buildpacks
0.001 Low
EPSS
Percentile
43.4%
github.com/knative/func is vulnerable to information disclosure. The vulnerability is due to compromised third-party buildpacks which expose their registry credentials or local docker socket to a malicious lifecycle container, which allows remote attackers to access unauthorized information. This only affects users who use third party function buildpacks.
References
github.com/knative/func/blob/5ca77d38744d3481cc0b795f607c5859b19588fc/buildpacks/builder.go#L37-L41
github.com/knative/func/commit/1d22cb21cfb111ef9c31ae8c640262709ccdb384
github.com/knative/func/pull/1442
github.com/knative/func/pull/1443
github.com/knative/func/releases/tag/knative-v1.8.1
github.com/knative/func/security/advisories/GHSA-5336-2g3f-9g3m
Related
cve
cve
CVE-2022-41939
2022-11-19 01:15:13
osv
osv
CVE-2022-41939
2022-11-19 01:15:13
prion
prion
Code injection
2022-11-19 01:15:00
nvd
nvd
CVE-2022-41939
2022-11-19 01:15:13
cvelist
cvelist