Published: 29/10/2021 Updated: 15/12/2021

CVSS v2 Base Score: 5.5 | Impact Score: 4.9 | Exploitability Score: 8

CVSS v3 Base Score: 7.1 | Impact Score: 4.2 | Exploitability Score: 2.8

VMScore: 490

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N

A security issue exists in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.

Vulnerable Product	Search on Vulmon	Subscribe to Product
kubernetes ingress-nginx
kubernetes ingress-nginx 1.0.0
netapp trident -

No description is available for this CVE ...

A security issue was discovered in ingress-nginx before versions 101 and 0491 where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster This issue cannot be fixed solely by upgrading ingress-nginx To mitigate, set allow-snippet-annotations to false in your ingress-nginx Co ...

oss-sec mailing list archives   By Date By Thread </form>    [kubernetes] CVE-2021-25742: Ingress-nginx custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets a ...

Kubernetes security tool for policy enforcement

The k-rail project has been deprecated and will receive no new features or bugfixes except in the case of critical security vulnerabilities We recommend migrating to an actively developed tool like OPA Gatekeeper that provides similar functionality k-rail is a workload policy enforcement tool for Kubernetes It can help you secure a multi tenant cluster with minimal disrupti

Some YAML files used while exploring options to implement micro-frontend architectures in Kubernetes and with Ingress Nginx controller.

Micro-frontends in Kubernetes Some YAML files used while exploring options to implement micro-frontend architectures in Kubernetes and with Ingress Nginx controller This YAMLs are the companion resources for an article I wrote in my personal blog: Micro-frontends and Ingress Nginx - Server Side Includes For testing out the different configuration scenarios, I recommend using a

NVD-CWE-noinfo https://groups.google.com/g/kubernetes-security-announce/c/mT4JJxi9tQY https://github.com/kubernetes/ingress-nginx/issues/7837 https://security.netapp.com/advisory/ntap-20211203-0001/https://nvd.nist.gov https://github.com/cruise-automation/k-rail https://access.redhat.com/security/cve/cve-2021-25742

CVE-2021-25742

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect