Résumé
Spinnaker: Improper yaml processing on kustomize bake operations
Détails de l’avis
Impact
Kustomize bake operations allow unsafe tag processing. This can lead to RCE type exploits on the rosco pods when doing kustomize bakes. This ONLY is possible when using Kustomize. The simple solution is to block kustomize operations and instead use another provider.
Workarounds
Disable kustomize bakes
Références
- https://github.com/advisories/GHSA-p68j-q7hf-3qcp
- https://github.com/spinnaker/spinnaker/security/advisories/GHSA-p68j-q7hf-3qcp
- https://nvd.nist.gov/vuln/detail/CVE-2026-55175
- https://github.com/spinnaker/spinnaker/commit/2d75818b85cc4c35144d5e5ed45e7340fcab5dfe
- https://github.com/spinnaker/spinnaker/commit/bbc30c9b9034a056e95f012fa1b34e9fd703cae7
- https://github.com/spinnaker/spinnaker/commit/de5a7a05af35aee19eb71d289cd0b77f67509009
- https://github.com/spinnaker/spinnaker/commit/df32d568e82519d9f3896fc9007baba0077c87fd
- https://github.com/spinnaker/spinnaker/commit/f5cec213f8cf207843ed5a6929395960a1ca094f
Vulnérabilités liées
Tout Supply chain →- HIGHCVE-2026-70035
Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability
- HIGHCVE-2026-87697
Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability
- HIGHCVE-2026-83520
Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability
- HIGHCVE-2026-106558
Backstage: Improper validation of TechDocs MkDocs configuration
- MEDIUMCVE-2026-83557
jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)
- MEDIUMGHSA-2jx3-ff3v-j7jj
yara-x: Unvalidated deserialization in safe `Rules::deserialize` allows memory corruption and UB