Ingress-nginx `path` sanitization can be bypassed with newline character

中 6.5CVE-2021-25748 · GHSA-863x-868h-968x · 24/05/2023 公開 · 17/06/2026 更新

要点

CVE-2021-25748 は k8s.io/ingress-nginx, ingress-nginx (kubernetes) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.69%（全脆弱性の 52.9% より高い）。
対処：1.2.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
k8s.io/ingress-nginx Go	`< 1.2.1`	`1.2.1`
ingress-nginx kubernetes	`< 1.2.1`	`1.2.1`

概要

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the spec.rules[].http.paths[].path field of an Ingress object (in the networking.k8s.io or extensions API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

NVD の説明

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the `spec.rules[].http.paths[].path` field of an Ingress object (in the `networking.k8s.io` or `extensions` API group) to obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.