-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/gardener/gardener | go | < 1.116.4 | 1.116.4 |
| github.com/gardener/gardener | go | >= 1.117.0, < 1.117.5 | 1.117.5 |
| github.com/gardener/gardener | go | >= 1.118.0, < 1.118.2 | 1.118.2 |
Miggo AIRoot Cause AnalysisThe vulnerability description points to metadata injection in the gardenlet component. The provided commit 9134cf81550807afc37b15fda09f36ddb8db7c6f directly addresses this by changing how referenced resources, specifically their annotations and labels, are handled before being copied to a seed cluster. The function PrepareReferencedResourcesForSeedCopy in pkg/utils/gardener/resources.go was modified to strip all annotations and labels, whereas previously it only removed a specific annotation. This indicates that the prior behavior of this function allowed potentially malicious metadata (annotations and labels) to be propagated, leading to the vulnerability. Therefore, this function was involved in processing the input that could be crafted for exploitation.
A Semantic Attack on Google Gemini - Read the Latest Research