Threats tagged 'ghsa-cvw6-gfvv-953q'

A vulnerability in Fission's Function admission webhook allows a tenant with permission to create Functions to specify an environment namespace different from their own. This bypasses namespace trust boundaries, enabling the attacker's function to run inside another tenant's container image. This can lead to code and credential theft or confused-deputy attacks. The issue is fixed in version 1.24.0 by validating that the environment namespace matches the function's namespace during admission and controller operations.