Threats tagged 'ghsa-37v5-fgfq-pwwf'

Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 through 3.12.1 with the bundled Keycloak enabled store Keycloak user passwords in cleartext within a Kubernetes ConfigMap. This includes the bootstrap administrator user with an admin role and a non-temporary password. Any principal with read access to ConfigMaps in the release namespace, such as users with the Kubernetes 'view' ClusterRole, can retrieve these passwords and gain full administrative access to BaSyx APIs. The issue is fixed in version 3.12.2 by moving user credentials to a Kubernetes Secret.