Bug 2012036 (CVE-2021-25742)

Summary:	CVE-2021-25742 k8s.io/ingress-nginx: Custom snippets allows retrieval of ingress-nginx serviceaccount token and secrets across all namespaces
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aos-bugs, bmontgom, eparis, gghezzo, gparvin, jburrell, joelsmith, jokerman, jramanat, lhinds, mfojtik, mmasters, nstielau, pahickey, security-response-team, sponnaga, stcannon, sttts, xxia
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-21 20:08:12 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2012037

Description Sam Fowler 2021-10-08 04:30:39 UTC

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use the custom snippets feature to obtain all secrets in the cluster.

Comment 2 Sam Fowler 2021-10-08 04:39:30 UTC

Upstream fix:

https://github.com/kubernetes/ingress-nginx/pull/7665

Also requires setting allow-snippet-annotations to false in the ingress-nginx ConfigMap.

Comment 3 Product Security DevOps Team 2021-10-21 20:08:12 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-25742

Comment 4 Sam Fowler 2021-11-04 20:59:28 UTC

Upstream issue:

https://github.com/kubernetes/ingress-nginx/issues/7837