Threats tagged 'ghsa-3r8v-2xmj-5c39'

A vulnerability in Fission prior to version 1.24.0 allows a function author in one namespace to read the deployment archive, including source code and embedded secrets, of any Package in any other namespace. This occurs because the admission webhook did not validate the PackageRef.Namespace field, allowing cross-namespace Package references. The issue is fixed in version 1.24.0 by enforcing namespace validation in the admission webhook.