-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
GoGoMiggo AIRoot Cause AnalysisThe analysis of the security patch commit c60246a43ae8c0c38dd7267f298d68a121a159fa clearly indicates that the vulnerability lies within the getIssuerCertificate function of the CertificateProvider struct, located in internal/pkg/reconcilers/operator/discoveryservicecertificate/providers/marin3r/crud.go. Before the patch, the function directly used the namespace provided in the DiscoveryServiceCertificate's spec.signer.caSigned.secretRef.namespace field to fetch a Kubernetes Secret. This allowed a user who could create a DiscoveryServiceCertificate in a given namespace to craft a resource that points to a Secret in a different, unauthorized namespace, thereby bypassing RBAC. The patch rectifies this by introducing a validation step that compares the namespace of the DiscoveryServiceCertificate resource with the namespace specified in the secretRef. If the namespaces do not match, the operation is aborted, and an error is returned. Therefore, the getIssuerCertificate function is the exact location of the vulnerability, as it was responsible for processing the malicious input (the cross-namespace secret reference).
CertificateProvider.getIssuerCertificateinternal/pkg/reconcilers/operator/discoveryservicecertificate/providers/marin3r/crud.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/3scale-sre/marin3r | go | <= 0.13.3 | 0.13.4 |