| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/fluid-cloudnative/fluid | < 0.9.3 | 0.9.3 |
| fluid | < 0.9.3 | 0.9.3 |
OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8s CRD Dataset/JuicefsRuntime, to execute arbitrary OS commands within the juicefs related containers. This could lead to unauthorized access, modification or deletion of data.
For users who're using version < 0.9.3 with JuicefsRuntime， upgrade to v0.9.3.
Are there any links users can visit to find out more?
Special thanks to the discovers of this issue:
Xiaozheng Zhang [email protected]
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free