CVE-2020-8553: Externally Controlled Reference to a Resource in Another Sphere

May 24, 2022 (updated July 13, 2023)

The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.

References

github.com/advisories/GHSA-hhpm-74pm-hf35
github.com/kubernetes/ingress-nginx/issues/5126
nvd.nist.gov/vuln/detail/CVE-2020-8553

Code Behaviors & Features

Detect and mitigate CVE-2020-8553 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →