-
Notifications
You must be signed in to change notification settings - Fork 2.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
PRISMA-2022-0227: Go-restful v3.9.0 is vulnerable to Authentication Bypass #1254
Comments
The Kubernetes server does not use go-restful CORS matching, so is unaffected by that vulnerability. Further, client-go doesn't make use of this module at all, so no vulnerabilities in that component are relevant to client-go users. Separately, updates to the latest version of this module in kubernetes generally are blocked on incompatibilities in the latest version - see kubernetes/kubernetes#115067 /close |
@liggitt: Closing this issue. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
PRISMA-2022-0227:
emicklei/go-restful/v3 module prior to v3.10.0 is vulnerable to Authentication Bypass by Primary Weakness. There is an inconsistency in how go-restful parses URL paths. This inconsistency could lead to several security check bypass in a complex system.
It is on the roadmap to fix it?
The text was updated successfully, but these errors were encountered: