HIGH 8.8
GHSA-gvrm-w2f9-f77q
Ingress-nginx path sanitization can be bypassed
Quick fix
GHSA-gvrm-w2f9-f77q — k8s.io/ingress-nginx: upgrade to the fixed version with the command below.
go get k8s.io/ingress-nginx@v1.8.0Details
Ingress-nginx `path` sanitization can be bypassed with `log_format` directive.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-4886 [ADVISORY]
- https://github.com/kubernetes/ingress-nginx/issues/10570 [WEB]
- https://github.com/kubernetes/ingress-nginx [PACKAGE]
- https://groups.google.com/g/kubernetes-security-announce/c/ge7u3qCwZLI [WEB]
- https://security.netapp.com/advisory/ntap-20240307-0013 [WEB]
- http://www.openwall.com/lists/oss-security/2023/10/25/5 [WEB]