Ingress-nginx `path` sanitization can be bypassed with `log_format` directive

Description

Affected products

Affected packages

Advisories 2

• WID-SEC-2024-0662 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2024
• WID-SEC-2024-1591 Juniper JUNOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2024

References

• https://github.com/kubernetes/ingress-nginx/issues/10570 issue-tracking
• https://groups.google.com/g/kubernetes-security-announce/c/ge7u3qCwZLI mailing-list
• http://www.openwall.com/lists/oss-security/2023/10/25/5
• https://security.netapp.com/advisory/ntap-20240307-0013/