VDB
Sign up
MEDIUM4.9

GHSA-m5xf-x7q6-3rm7

KubeVela VelaUX APIserver has SSRF vulnerability

Quick fix

GHSA-m5xf-x7q6-3rm7 — github.com/oam-dev/kubevela: upgrade to the fixed version with the command below.

go get github.com/oam-dev/kubevela@v1.6.2

Details

### Impact Users using the VelaUX APIServer could be affected by this vulnerability.

When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability.

This issue is patched in 1.5.9 and 1.6.2.

### References Fix by: #5000

### For more information If you have any questions or comments about this advisory: * Open an issue in [KubeVela repo](https://github.com/kubevela/kubevela) * Email us at [here](https://github.com/kubevela/kubevela#contact-us)

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/oam-dev/kubevela
Introduced in: 1.6.0-alpha.1Fixed in: 1.6.2
Fixgo get github.com/oam-dev/kubevela@v1.6.2
Go/github.com/oam-dev/kubevela
Introduced in: 0Fixed in: 1.5.9
Fixgo get github.com/oam-dev/kubevela@v1.5.9

References