PT-2023-12724 · Weave · Weave Gitops

Pjbgf · Publicado 2023-01-09 · Atualizado 2024-08-20 · CVE-2022-23509

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:A/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Weave GitOps versions prior to v0.12.0

Description The communication between GitOps Run and the local S3 bucket is not encrypted, allowing privileged users or processes to tap the local traffic and gain information permitting access to the S3 bucket. This could result in changes to the bucket content, leading to modifications in the Kubernetes cluster's resources. There are no known workarounds for this issue.

Recommendations For Weave GitOps versions prior to v0.12.0, upgrade to Weave GitOps version >= v0.12.0 released on 08/12/2022. As a temporary workaround, consider restricting access to the local S3 bucket to minimize the risk of exploitation.

Exploit

Correção

Cleartext Transmission of Sensitive Information

Information Disclosure

Enumeração de Fraquezas

CWE-319

CWE-200

Identificadores relacionados

CVE-2022-23509

GHSA-89QM-WCMW-3MGG

GO-2023-1388

Produtos afetados

Weave Gitops

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23509.json · Exploit
• https://github.com/weaveworks/weave-gitops · Nota
• https://github.com/weaveworks/weave-gitops/pull/3098/commits/babd91574b99b310b84aeec9f8f895bd18acb967 · Correção
• https://github.com/weaveworks/weave-gitops/pull/3106/commits/ce2bbff0a3609c33396050ed544a5a21f8d0797f · Correção
• https://github.com/weaveworks/weave-gitops/security/advisories/GHSA-89qm-wcmw-3mgg · Nota
• https://t.me/cibsecurity/56154 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-23509 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-23509 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-89qm-wcmw-3mgg · Aviso do Fabricante
• https://t.me/cvenotify/41561 · Publicação no Telegram
• https://osv.dev/vulnerability/GO-2023-1388 · Aviso do Fabricante