Threats tagged 'ghsa-vchh-r53j-8mpw'

A validation bypass vulnerability exists in the HTTPTrigger resource of the Fission project (github.com/fission/fission) through version 1.24.0. The fields RelativeURL and Prefix were only validated at the CLI level, not at the API server admission level, allowing creation of HTTPTriggers with unsafe or conflicting URL paths via kubectl apply or direct API calls. This could lead to triggers with empty URLs, paths not starting with '/', paths containing directory traversal segments, or collisions with reserved router paths. The issue was fixed in version 1.25.0 by enforcing consistent validation rules at both the API server and CLI layers.