Ingress-nginx code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-5044 · ADVISORY
• kubernetes/ingress-nginx · WEB
• kubernetes/ingress-nginx · PACKAGE
• groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0 · WEB
• security.netapp.com/advisory/ntap-20240307-0012 · WEB
• openwall.com/lists/oss-security/2023/10/25/3 · WEB
• security.netapp.com/advisory/ntap-20240307-0012
• GitHub Advisory GHSA-fp9f-44c2-cw27 · ADVISORY

k8s.io/ingress-nginx のその他の脆弱性

• CVE-2026-4342高 8.8A security issue was discovered in ingress-nginx where a combination of Ingress annotations can be used to inject configuration into nginx. …
• CVE-2026-24514中 6.5A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service conditi…
• CVE-2026-24513低 3.1A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in …
• CVE-2026-24512高 8.8A security issue was discovered in ingress-nginx where the `rules.http.paths.path` Ingress field can be used to inject configuration into ng…
• CVE-2026-1580高 8.8A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to injec…