Description
OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.2 and 1.1.2, internal/cluster-gateway/server.go served caller-facing management APIs on the externally reachable agent listener without authentication, allowing network-reachable attackers to invoke /api/proxy/ and /api/exec/ operations, proxy the data-plane Kubernetes API, and execute commands in workload pods in multi-cluster deployments. This issue is fixed in versions 1.0.2 and 1.1.2.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
openchoreo openchoreo
< 1.0.2affected>= 1.1.0, < 1.1.2affected
References
- https://github.com/openchoreo/openchoreo/security/advisories/GHSA-qh9r-j7rp-4x2m ↗
- https://github.com/openchoreo/openchoreo/pull/4122 ↗
- https://github.com/openchoreo/openchoreo/commit/047d80ddc63b4b4b9dd67044d5cffcdbd77685ce ↗
- https://github.com/openchoreo/openchoreo/commit/0aa0ffe1623bd8eb4235cb2a5854336695953c3a ↗
- https://github.com/openchoreo/openchoreo/commit/b42eeb0f5dce95195a9781d7c5a1fe9e38f5da8f ↗
- https://github.com/openchoreo/openchoreo/releases/tag/v1.0.2 ↗
- https://github.com/openchoreo/openchoreo/releases/tag/v1.1.2 ↗