Описание
Inspektor Gadget Security Policies Can be Bypassed
Security policies like allowed-gadgets, disallow-pulling, verify-image can be bypassed by a malicious client.
Impact
Users running ig in daemon mode or IG on Kubernetes that rely on any of the features mentioned above are vulnerable to this issue. In order to exploit this, the client needs access to the server, like the correct TLS certificates on the ig daemon case or access to the cluster in the Kubernetes case.
Patches
The issue has been fixed in v0.40.0
Workarounds
There is not known workaround to fix it.
Пакеты
Наименование
github.com/inspektor-gadget/inspektor-gadget
go
Затронутые версииВерсия исправления
>= 0.31.0, < 0.40.0
0.40.0
6.7 Medium
CVSS3
Дефекты
CWE-285
6.7 Medium
CVSS3
Дефекты
CWE-285