oss-security - [kubernetes] Multiple vulnerabilities in ingress-nginx

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAM62Sm+vJ9YomjArHHzBZwKvVBqnpZZQkCZOCfYTCsHfsn20tw@mail.gmail.com>
Date: Mon, 24 Mar 2025 14:38:17 -0500
From: Tabitha Sable <tabitha.c.sable@...il.com>
To: oss-security@...ts.openwall.com
Subject: [kubernetes] Multiple vulnerabilities in ingress-nginx

Hello oss-sec,

Multiple issues have been discovered in ingress-nginx that can result in
arbitrary code execution in the context of the ingress-nginx controller.
This can lead to disclosure of Secrets accessible to the controller. (Note
that in the default installation, the controller can access all Secrets
cluster-wide.)

The most serious of these issues has been rated Critical (
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
<https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H>)
(Score: 9.8), and assigned CVE-2025-1974.
Am I vulnerable?

   -

   This issue affects ingress-nginx. If you do not have ingress-nginx
   installed on your cluster, you are not affected.
   -

   You can check this by running kubectl get pods --all-namespaces
   --selector app.kubernetes.io/name=ingress-nginx

Affected Versions

   -

   All versions prior to v1.11.0
   -

   v1.11.0 - 1.11.4
   -

   v1.12.0

How do I mitigate this vulnerability?

ACTION REQUIRED: The following steps must be taken to mitigate these
vulnerabilities: Upgrade ingress-nginx to v1.11.5, v1.12.1, or any later
version.

Before applying the patch, these issues can be partially mitigated by
disabling the Validating Admission Controller functionality of
ingress-nginx.
Fixed Versions

   -

   v1.11.5
   -

   v1.12.1

To upgrade, refer to the documentation: Upgrading Ingress-nginx
<https://kubernetes.github.io/ingress-nginx/deploy/upgrade/>
Detection

If you find evidence that these vulnerabilities have been exploited, please
contact security@...ernetes.io
Additional Details

See these GitHub issues for more details:
CVE-2025-24513: https://github.com/kubernetes/kubernetes/issues/131005

CVE-2025-24514: https://github.com/kubernetes/kubernetes/issues/131006

CVE-2025-1097: https://github.com/kubernetes/kubernetes/issues/131007

CVE-2025-1098: https://github.com/kubernetes/kubernetes/issues/131008

CVE-2025-1974: https://github.com/kubernetes/kubernetes/issues/131009
Acknowledgements

These vulnerabilities were reported by Nir Ohfeld, Ronen Shustin, Sagi
Tzadik, and Hillai Ben Sasson, from Wiz

These issues were fixed and coordinated by Marco Ebert, James Strong,
Tabitha Sable, and the Kubernetes Security Response Committee

Thank You,

Tabitha Sable, on behalf of the Kubernetes Security Response Committee

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.