x/vulndb: potential Go vuln in github.com/kubernetes/ingress-nginx: CVE-2024-7646

[GoVulnBot]

Advisory CVE-2024-7646 references a vulnerability in the following Go modules:

Module
github.com/kubernetes/ingress-nginx

Description:
A security issue was discovered in ingress-nginx where an actor with permission to create Ingress objects (in the networking.k8s.io or extensions API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-7646
• FIX: chore: make the auth verify regex more strict kubernetes/ingress-nginx#11719
• FIX: Perform some cleaning operations on line breaks. kubernetes/ingress-nginx#11721
• REPORT: CVE-2024-7646: Ingress-nginx Annotation Validation Bypass kubernetes/kubernetes#126744
• WEB: https://groups.google.com/g/kubernetes-security-announce/c/a1__cKjWkfA

Cross references:

• github.com/kubernetes/ingress-nginx appears in 1 other report(s):
  • data/excluded/GO-2023-2252.yaml (x/vulndb: potential Go vuln in github.com/kubernetes/ingress-nginx: CVE-2019-20372 #2252) LEGACY_FALSE_POSITIVE

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/kubernetes/ingress-nginx
      vulnerable_at: 1.0.0-alpha.1
summary: CVE-2024-7646 in github.com/kubernetes/ingress-nginx
cves:
    - CVE-2024-7646
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-7646
    - fix: https://github.com/kubernetes/ingress-nginx/pull/11719
    - fix: https://github.com/kubernetes/ingress-nginx/pull/11721
    - report: https://github.com/kubernetes/kubernetes/issues/126744
    - web: https://groups.google.com/g/kubernetes-security-announce/c/a1__cKjWkfA
source:
    id: CVE-2024-7646
    created: 2024-08-16T19:01:20.772629538Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/606361 mentions this issue: data/reports: add 2 unreviewed reports