CVE-2020-1701: Incorrect Permission Assignment for Critical Resource

May 27, 2021 (updated June 10, 2021)

A flaw was found in the KubeVirt main virt-handler regarding the access permissions of virt-handler. An attacker with access to create VMs could attach any secret within their namespace, allowing them to read the contents of that secret.

References

bugzilla.redhat.com/show_bug.cgi?id=1792092
nvd.nist.gov/vuln/detail/CVE-2020-1701

Code Behaviors & Features

Detect and mitigate CVE-2020-1701 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →