x/vulndb: potential Go vuln in github.com/metal3-io/baremetal-operator: CVE-2024-43803

[GoVulnBot]

Advisory CVE-2024-43803 references a vulnerability in the following Go modules:

Module
github.com/metal3-io/baremetal-operator

Description:
The Bare Metal Operator (BMO) implements a Kubernetes API for managing bare metal hosts in Metal3. The BareMetalHost (BMH) CRD allows the userData, metaData, and networkData for the provisioned host to be specified as links to Kubernetes Secrets. There are fields for both the Name and Namespace of the Secret, meaning that versions of the baremetal-operator prior to 0.8.0, 0.6.2, and 0.5.2 will read a Secret from any namespace. A user with access to create or edit a BareMetalHost can thus exfiltrate a Secret from another namespace by using it as e.g. the userData for provisi...

References:

• ADVISORY: https://nvd.nist.gov/vuln/detail/CVE-2024-43803
• FIX: metal3-io/baremetal-operator@3af4882
• FIX: metal3-io/baremetal-operator@bedae7b
• FIX: metal3-io/baremetal-operator@c2b5a55
• FIX: 🐛 Disallow fetching secrets from namespaces different from the host's one metal3-io/baremetal-operator#1929
• FIX: 🐛 Disallow fetching secrets from namespaces different from the host's one metal3-io/baremetal-operator#1930
• FIX: 🐛 Disallow fetching secrets from namespaces different from the host's one metal3-io/baremetal-operator#1931
• WEB: GHSA-pqfh-xh7w-7h3p

Cross references:

• github.com/metal3-io/baremetal-operator appears in 1 other report(s):
  • data/excluded/GO-2023-1746.yaml (x/vulndb: potential Go vuln in github.com/metal3-io/baremetal-operator: CVE-2023-30841 #1746) NOT_GO_CODE

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/metal3-io/baremetal-operator
      vulnerable_at: 0.8.0
summary: CVE-2024-43803 in github.com/metal3-io/baremetal-operator
cves:
    - CVE-2024-43803
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-43803
    - fix: https://github.com/metal3-io/baremetal-operator/commit/3af4882e9c5fadc1a7550f53daea21dccd271f74
    - fix: https://github.com/metal3-io/baremetal-operator/commit/bedae7b997d16f36e772806681569bb8eb4dadbb
    - fix: https://github.com/metal3-io/baremetal-operator/commit/c2b5a557641bc273367635124047d6c958aa15f7
    - fix: https://github.com/metal3-io/baremetal-operator/pull/1929
    - fix: https://github.com/metal3-io/baremetal-operator/pull/1930
    - fix: https://github.com/metal3-io/baremetal-operator/pull/1931
    - web: https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-pqfh-xh7w-7h3p
source:
    id: CVE-2024-43803
    created: 2024-09-03T20:01:19.986106162Z
review_status: UNREVIEWED