Input validation error in Ingress-NGINX Controller for Kubernetes - CVE-2024-7646
Published: December 30, 2024
Vulnerability identifier: #VU102099
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-7646
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform a denial of service (DoS) attack.
The vulnerability exists due to in the default configuration some credential has access to all secrets in the cluster.. A remote user with permission to create Ingress objects (in the `networking.k8s.io` or `extensions` API group) can bypass annotation validation to inject arbitrary commands and obtain the credentials of the ingress-nginx controller.
Affected software
Ingress-NGINX Controller for Kubernetes
IBM Watson Discovery for IBM Cloud Pak for Data
IBM API Connect
IBM InfoSphere Information Server
IBM Watson Discovery for IBM Cloud Pak for Data
IBM API Connect
IBM InfoSphere Information Server
How to mitigate CVE-2024-7646
Install updates from vendor's website.
Ingress-NGINX Controller for Kubernetes - update to 1.11.2
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.7, 5.0.3, 5.1.0
IBM API Connect - update to 10.0.9.0
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5
IBM Watson Discovery for IBM Cloud Pak for Data - addressed in versions 4.8.7, 5.0.3, 5.1.0
IBM API Connect - update to 10.0.9.0
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5