CVE-2021-41254

{"id": "CVE-2021-41254", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-11-12T18:15:07.600", "references": [{"url": "https://github.com/fluxcd/kustomize-controller/security/advisories/GHSA-35rf-v2jv-gfg7", "tags": ["Exploit", "Mitigation", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "kustomize-controller is a Kubernetes operator, specialized in running continuous delivery pipelines for infrastructure and workloads defined with Kubernetes manifests and assembled with Kustomize. Users that can create Kubernetes Secrets, Service Accounts and Flux Kustomization objects, could execute commands inside the kustomize-controller container by embedding a shell script in a Kubernetes Secret. This can be used to run `kubectl` commands under the Service Account of kustomize-controller, thus allowing an authenticated Kubernetes user to gain cluster admin privileges. In affected versions multitenant environments where non-admin users have permissions to create Flux Kustomization objects are affected by this issue. This vulnerability was fixed in kustomize-controller v0.15.0 (included in flux2 v0.18.0) released on 2021-10-08. Starting with v0.15, the kustomize-controller no longer executes shell commands on the container OS and the `kubectl` binary has been removed from the container image. To prevent the creation of Kubernetes Service Accounts with `secrets` in namespaces owned by tenants, a Kubernetes validation webhook such as Gatekeeper OPA or Kyverno can be used."}, {"lang": "es", "value": "kustomize-controller es un operador de Kubernetes, especializado en la ejecuci\u00f3n de pipelines de entrega continua para infraestructuras y cargas de trabajo definidas con manifiestos de Kubernetes y montadas con Kustomize. Los usuarios que pueden crear secretos de Kubernetes, cuentas de servicio y objetos de personalizaci\u00f3n de Flux, podr\u00edan ejecutar comandos dentro del contenedor kustomize-controller al insertar un script de shell en un Secreto de Kubernetes. Esto puede ser usado para ejecutar comandos \"kubectl\" bajo la Cuenta de Servicio de kustomize-controller, permitiendo as\u00ed que un usuario autenticado de Kubernetes obtenga privilegios de administrador de cluster. En las versiones afectadas, los entornos multitenant en los que los usuarios que no son administradores tienen permisos para crear objetos de personalizaci\u00f3n de Flux est\u00e1n afectados por este problema. Esta vulnerabilidad fue corregida en kustomize-controller versi\u00f3n v0.15.0 (incluida en flux2 versi\u00f3n v0.18.0) publicada el 08-10-2021. A partir de la versi\u00f3n v0.15, el kustomize-controller ya no ejecuta comandos shell en el Sistema Operativo del contenedor y el binario \"kubectl\" ha sido eliminado de la imagen del contenedor. Para evitar la creaci\u00f3n de cuentas de servicio de Kubernetes con \"secrets\" en espacios de nombres propiedad de los inquilinos, puede usarse un webhook de comprobaci\u00f3n de Kubernetes como Gatekeeper OPA o Kyverno"}], "lastModified": "2021-11-17T13:29:20.383", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:fluxcd:kustomize-controller:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55E106A2-0528-4420-8BFC-81B18F645A40", "versionEndExcluding": "0.15.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}