Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/metal3-io/baremetal-operator

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.9GoPublished

    The Bare Metal Operator (BMO) can expose particularly named secrets from other namespaces via BMH CRD

    CVE-2024-43803 · GHSA-pqfh-xh7w-7h3p

    Affected
    • Go github.com/metal3-io/baremetal-operator >= 0.7.0-rc.0, < 0.8.0; >= 0.6.0, < 0.6.2; < 0.5.2
    Fixed in
    0.5.20.8.00.6.2· Vendor fix available
    Issue
    Impact The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost (BMH) CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for both the Name and Namespace of the Secret, meaning that the baremetal-operator will read a Secret from any namespace. A user with access to create or edit a BareMetalHost can thus exfiltrate a Secret from another namespace by using it as e.g. the userData for provisioning some host (note that this need not be a real host, it could be a VM somewhere). Limiting factors BMO will only read a key with the name value (or userData, metaData, or networkData), so that limits the exposure somewhat. value is probably a pretty common key though. Secrets used by other BareMetalHosts in different namespaces are always vulnerable. It is probably relatively unusual for anyone other than cluster administrators to have RBAC access…

    Recommended action: Upgrade to 0.8.0, 0.6.2 or 0.5.2 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 6.0GoPublished

    Ironic and ironic-inspector may expose as ConfigMaps

    CVE-2023-30841 · GHSA-9wh7-397j-722m

    Affected
    • Go github.com/metal3-io/baremetal-operator < 0.3.0
    Fixed in
    0.3.0· Vendor fix available
    Issue
    Impact Ironic and ironic-inspector deployed within Baremetal Operator using the included deploy.sh store their .htpasswd files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. Patches This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. Workarounds User may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241

    Recommended action: Upgrade to 0.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →