Vulnerabilities in pkg:golang/github.com/clastix/kamaji
PACKAGECVE-2024-42480 is a CRITICAL (CVSS 8.1) rbac roles for `etcd` created vulnerability (CWE-284: Improper Access Control) affecting Github.com/clastix/kamaji libraries in the Go ecosystem. The issue involves rbac roles for `etcd` created by kamaji are not disjunct. Remediation is available in the latest vendor maintenance releases.
pkg:golang/github.com/clastix/kamaji
Vulnerability advisories affecting package pkg:golang/github.com/clastix/kamaji. Select an advisory below to view technical details or fixes.
| Advisory ID | CVE / NVD | Severity | Summary |
|---|---|---|---|
| GHSA-6r4j-4rjc-8vw5 | CVE-2024-42480 | CRITICAL | RBAC Roles for `etcd` created by Kamaji are not disjunct |
CVE-2024-42480 at a Glance
Security Impact
CVSS: 8.1
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
How to Fix CVE-2024-42480
To remediate this vulnerability, upgrade all affected Github.com/clastix/kamaji dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/clastix/kamaji to Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/clastix/kamajiHow to Check if You Are Affected
To determine whether your application is affected by CVE-2024-42480, inspect your project dependencies for Github.com/clastix/kamaji:
inspect dependencies for github.com/clastix/kamajiAnalyze the terminal output to locate any version of Github.com/clastix/kamaji in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-284: Improper Access Control, where the product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. In Github.com/clastix/kamaji, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-42480 Affected Github.com/clastix/kamaji Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/clastix/kamaji
|
Go |
≤ 1.0.0
|
|
References
Frequently Asked Questions
What is CVE-2024-42480?
Which Github.com/clastix/kamaji versions are affected?
What version fixes CVE-2024-42480?
Is github.com/clastix/kamaji affected?
What is the CVSS score of CVE-2024-42480?
What CWE is associated with CVE-2024-42480?
How can I check Go dependencies for CVE-2024-42480?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-6r4j-4rjc-8vw5",
"modified" : "2024-11-18T16:27:03Z",
"published" : "2024-08-12T18:22:06Z",
"aliases" : [ "CVE-2024-42480" ],
"summary" : "RBAC Roles for `etcd` created by Kamaji are not disjunct",
"details" : "### Summary\n_Using an \"open at the top\" range definition in RBAC for etcd roles leads to some TCPs API servers being able to read, write and delete the data of other control planes._\n\n### Details\n\nThe problematic code is this: https://github.com/clastix/kamaji/blob/8cdc6191242f80d120c46b166e2102d27568225a/internal/datastore/etcd.go#L19-L24\n\nThe range created by this RBAC setup code looks like this:\n\n```\netcdctl role get example\nRole example\nKV Read:\n\t[/example/, \\0)\nKV Write:\n\t[/example/, \\0)\n```\n\nThe range end `\\0` means \"everything that comes after\" in etcd, so potentially all the key prefixes of controlplanes with a name that comes after \"example\" when sorting lexically (e.g. `example1`, `examplf`, all the way to `zzzzzzz` if you will).\n\n### PoC\n\n1. Create two TCP in the same Namespace\n2. Scale Kamaji to zero to avoid reconciliations\n3. change the Kubernetes API Server `--etcd-prefix` flag value to point to the other TCP datastore key\n4. wait it for get it up and running\n5. use `kubectl` and will notice you're reading and writing data of another Tenant\n\n### Impact\n\nFull control over other TCPs data, if you are able to obtain the name of other TCPs that use the same datastore and are able to obtain the user certificates used by your control plane (or you are able to configure the kube-apiserver Deployment, as shown in the PoC).\n",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/clastix/kamaji"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"last_affected" : "1.0.0"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/clastix/kamaji/security/advisories/GHSA-6r4j-4rjc-8vw5"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2024-42480"
}, {
"type" : "WEB",
"url" : "https://github.com/clastix/kamaji/commit/1731e8c2ed5148b125ecfbdf091ee177bd44f3db"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/clastix/kamaji"
}, {
"type" : "WEB",
"url" : "https://github.com/clastix/kamaji/blob/8cdc6191242f80d120c46b166e2102d27568225a/internal/datastore/etcd.go#L19-L24"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-284" ],
"severity" : "CRITICAL",
"github_reviewed" : true,
"github_reviewed_at" : "2024-08-12T18:22:06Z",
"nvd_published_at" : "2024-08-12T16:15:15Z"
}
}