Virb3

**Name of the Vulnerable Software and Affected Versions** Romeo versions prior to 0.2.1 **Description** Romeo is a tool designed to measure code coverage for Go applications within GitHub Actions. A misconfigured NetworkPolicy allows a malicious actor to move from the "hardened" namespace to any other Pod, breaking the expected security-by-default behavior and potentially enabling lateral movement. The issue stems from a mis-written NetworkPolicy. **Recommendations** Update to version 0.2.1 or later. If updates are not possible, manually delete the `inter-ns` NetworkPolicy. Delete any failing network policy prefixed by `inter-ns-` in the target namespace.

**Name of the Vulnerable Software and Affected Versions** Chall-Manager versions prior to 0.6.5 **Description** Chall-Manager is a platform-agnostic system designed to initiate challenges on demand. A misconfigured NetworkPolicy in versions prior to 0.6.5 allows a malicious actor to move laterally from one instance to any Pod outside its original namespace, compromising the expected security-by-default behavior. Specifically, `sdk/kubernetes.Kompose` does not provide instance isolation. The issue stems from a mis-written NetworkPolicy that enables unauthorized access between namespaces. **Recommendations** Versions prior to 0.6.5 should be updated to version 0.6.5 or later. If updates are not immediately possible, manually delete the `inter-ns` NetworkPolicy. As a workaround, delete any network policies prefixed with `inter-ns-` in the target namespace using the provided bash script, or manually if preferred.

**Name of the Vulnerable Software and Affected Versions** Fullchain versions prior to 0.1.1 **Description** Fullchain is a platform for deploying CTF (Capture The Flag) environments. A misconfigured NetworkPolicy allows a malicious actor to move laterally from a compromised application to any Pod in a different namespace. This breaks the expected security-by-default behavior of the deployment program. The flawed NetworkPolicy is identified as `inter-ns`. This issue does not involve any known real-world incidents or a specific number of affected devices. **Recommendations** Versions prior to 0.1.1 should be updated to version 0.1.1. As a workaround, delete the failing `inter-ns-` prefixed NetworkPolicy in the target namespace. Alternatively, use the provided bash script to delete all matching network policies, but proceed with caution and consider manual deletion if unsure of the outcome.

**Name of the Vulnerable Software and Affected Versions** CTFer.io Monitoring versions prior to 0.2.1 **Description** The CTFer.io Monitoring component handles the collection, processing, and storage of signals like logs, metrics, and distributed traces. A misconfigured NetworkPolicy allows a malicious actor to move laterally from one component to any other namespace. This compromises the expected security-by-default behavior of the deployment. The issue results in a potential lateral movement within the system. **Recommendations** Versions prior to 0.2.1: Remove the `inter-ns` NetworkPolicy to address the issue. If updates are not immediately feasible, manually delete the network policy prefixed with `inter-ns-` in the monitoring namespace. The following command can be used to delete all matching network policies: ```bash for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}' | tr ' ' ' ' | grep '^monitoring-'); do kubectl -n "$ns" get networkpolicy -o name | grep '^networkpolicy.networking.k8s.io/inter-ns-' | xargs -r kubectl -n "$ns" delete done ```