CRITICAL9.9

GHSA-74j8-w7f9-pp62

Improper configuration of RBAC permissions obtaining cluster control permissions

Quick fix

GHSA-74j8-w7f9-pp62 — github.com/labring/sealos: upgrade to the fixed version with the command below.

go get github.com/labring/sealos@v4.2.1-rc4

Details

### Summary Improper configuration of RBAC permissions resulted in obtaining cluster control permissions, which could control the entire cluster deployed with Sealos, as well as hundreds of pods and other resources within the cluster.

### Details detail's is disable by publish.

### PoC detail's is disable by publish.

### Impact + sealos public cloud user + CWE-287 Improper Authentication

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/labring/sealos

Introduced in: 0Fixed in: 4.2.1-rc4

Fixgo get github.com/labring/sealos@v4.2.1-rc4

References

https://github.com/labring/sealos/security/advisories/GHSA-74j8-w7f9-pp62[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2023-33190[ADVISORY]
https://github.com/labring/sealos/commit/4cdf52e55666864e5f90ed502e9fc13e18985b7b[WEB]
https://github.com/labring/sealos[PACKAGE]