-
Notifications
You must be signed in to change notification settings - Fork 55
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
x/vulndb: potential Go vuln in github.com/coreos/ignition: CVE-2022-1706 #451
Labels
excluded: NOT_IMPORTABLE
This vulnerability only exists in a binary and is not importable.
Comments
Vulnerability in tool. |
Change https://go.dev/cl/592768 mentions this issue: |
Change https://go.dev/cl/607218 mentions this issue: |
gopherbot
pushed a commit
that referenced
this issue
Aug 21, 2024
- data/reports/GO-2022-0407.yaml - data/reports/GO-2022-0410.yaml - data/reports/GO-2022-0413.yaml - data/reports/GO-2022-0416.yaml - data/reports/GO-2022-0418.yaml - data/reports/GO-2022-0424.yaml - data/reports/GO-2022-0426.yaml - data/reports/GO-2022-0429.yaml - data/reports/GO-2022-0440.yaml - data/reports/GO-2022-0442.yaml - data/reports/GO-2022-0447.yaml - data/reports/GO-2022-0448.yaml - data/reports/GO-2022-0449.yaml - data/reports/GO-2022-0450.yaml - data/reports/GO-2022-0451.yaml - data/reports/GO-2022-0452.yaml - data/reports/GO-2022-0453.yaml - data/reports/GO-2022-0454.yaml - data/reports/GO-2022-0455.yaml - data/reports/GO-2022-0456.yaml Updates #407 Updates #410 Updates #413 Updates #416 Updates #418 Updates #424 Updates #426 Updates #429 Updates #440 Updates #442 Updates #447 Updates #448 Updates #449 Updates #450 Updates #451 Updates #452 Updates #453 Updates #454 Updates #455 Updates #456 Change-Id: I206c09343a83edd1fd9f1a37410a59391d904c6d Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/607218 Reviewed-by: Damien Neil <dneil@google.com> Auto-Submit: Tatiana Bradley <tatianabradley@google.com> LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
CVE-2022-1706 references github.com/coreos/ignition, which may be a Go module.
Description:
A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.
Links:
See doc/triage.md for instructions on how to triage this report.
The text was updated successfully, but these errors were encountered: