Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle (MitM) attack against services using Steve. For example, Rancher relies on Steve as a dependency for its user interface (UI) to proxy requests to Kubernetes clusters. Users who have the permission to create a service in Rancher’s local cluster can take over Rancher’s UI and display their own UI to gather sensitive information. This is only possible when the setting ui-offline-preferred is manually set to remote (by default Rancher sets it to dynamic). This enables further attacks such as cross-site scripting (XSS), or tampering the UI to collect passwords from other users etc. Please consult the associated MITRE ATT&CK - Technique - Adversary-in-the-Middle for further information about this category of attack. Patches Patched…
Recommended action: Upgrade to 0.5.13, 0.4.4, 0.3.3 or 0.2.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/rancher/steve < 0.0.0-20241029132712-2175e090fe4b
Fixed in
0.0.0-20241029132712-2175e090fe4b· Vendor fix available
Issue
Impact A vulnerability has been discovered in Steve API (Kubernetes API Translator) in which users can watch resources they are not allowed to access, when they have at least some generic permissions on the type. For example, a user who can get a single secret in a single namespace can get all secrets in every namespace. During a watch request for a single ID, the following occurs: - In the case of a watch request for a single resource, Steve API will return a partition with the requested resource in it. In other cases, it will check the user's access when constructing partitions. - When a watch request for a single resource is issued, instead of using a client which impersonates the user making the request, Steve API will use the admin client, which can read all resources. This allows any requester to see the contents of any object such as secret keys, signing certificates, API tokens. Please consult the associated MITRE ATT&CK - Technique - Valid Accounts and MITRE ATT&CK -…
Recommended action: Upgrade to 0.0.0-20241029132712-2175e090fe4b (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.