Description
The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | ingress-nginx | unspecified – < 0.28.0 | 0.28.0 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/ingress-nginx | < 0.28.0 | 0.28.0 | GHSA-hhpm-74pm-hf35 |