Threats tagged 'ghsa-5w5g-j6hw-6p8f'

A vulnerability in the osac-console-proxy component of the osac-operator allows remote code execution and server-side request forgery (SSRF). The console-proxy improperly processes kubeconfig data from Kubernetes Secrets without sanitizing exec plugin configurations, enabling execution of arbitrary processes with the proxy's service account privileges. This affects deployments using remote or auto VM cluster modes. A patch is available in version 0.0.4.