Threats tagged 'ghsa-vjhc-cf4p-72q4'

Fission's buildermgr controller failed to verify that the Package Custom Resource Definition (CRD) environment namespace matched the package's own namespace. This allowed an attacker with package creation rights in their own namespace to specify a different namespace for the environment, causing the controller to execute build commands in another tenant's namespace. Malicious build steps could exfiltrate the victim namespace's fission-builder service account token via build logs, enabling read access to all Secrets and ConfigMaps in that namespace. The issue was fixed in Fission v1.24.0 by enforcing namespace checks both at admission webhook and controller levels.