Threats tagged 'ghsa-qf5v-m7p4-95rp'

Fission versions up to 1.24.0 implemented PodSpec validation with a fixed denylist of Linux capabilities but omitted CAP_SYS_TIME. This omission allows tenants to add CAP_SYS_TIME to their function or environment containers, enabling them to alter the node's real-time clock. Since the Linux real-time clock is shared across the node, this can corrupt time-dependent operations for all workloads on that node. The vulnerability is fixed in Fission 1.25.0 by replacing the denylist with a restrictive allowlist for capabilities. The issue does not apply if a restrictive Pod Security Admission profile is enforced on the function-pod namespace.