Description (CNA)
MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is fixed in version 0.13.4.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| 3scale-sre / marin3r | affected < 0.13.4 |
CWE
CWE-862
References
- https://github.com/3scale-sre/marin3r/security/advisories/GHSA-gf93-xccm-5g6j
- https://github.com/3scale-sre/marin3r/commit/859b14115fde1d67620e645cd1b62e90e30d9981
ADP enrichment
No English description supplied.
No references supplied.