CVE-2021-23021

概要

参考情報

• support.f5.com/csp/article/K36926027 · Vendor Advisory

nginx controller のその他の脆弱性

• CVE-2021-23020中 5.5The NAAS 3.x before 3.10.0 API keys were generated using an insecure pseudo-random string and hashing algorithm which could lead to predicta…
• CVE-2021-23019高 7.8The NGINX Controller 2.0.0 thru 2.9.0 and 3.x before 3.15.0 Administrator password may be exposed in the systemd.txt file that is included i…
• CVE-2021-23018高 7.4Intra-cluster communication does not use TLS. The services within the NGINX Controller 3.x before 3.4.0 namespace are using cleartext protoc…
• CVE-2020-27730緊急 9.8In versions 3.0.0-3.9.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller Agent does not use absolute paths when calling system utilities.
• CVE-2020-5911高 7.3In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL …