What is GHSA-9wh7-397j-722m?

GHSA-9wh7-397j-722m is a security advisory published by GitHub Security Advisories with Medium severity. Ironic and ironic-inspector may expose as ConfigMaps

Which CVE IDs does GHSA-9wh7-397j-722m cover?

GHSA-9wh7-397j-722m covers the following CVE IDs: CVE-2023-30841. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9wh7-397j-722m?

GHSA-9wh7-397j-722m has a CVSS v3 base score of 6.0, published by GitHub Security Advisories.

Which products are affected by GHSA-9wh7-397j-722m?

GHSA-9wh7-397j-722m affects 1 product, including: go/github.com/metal3-io/baremetal-operator:\u003c 0.3.0.

GHSA-9wh7-397j-722mMediumCVSS 6.0

Ironic and ironic-inspector may expose as ConfigMaps

Vendor

GitHub Security Advisories

Published

April 26, 2023

Last Modified

November 7, 2023

🔗 CVE IDs covered (1)

CVE-2023-30841 →

📋 Description

Impact

Ironic and ironic-inspector deployed within Baremetal Operator using the included deploy.sh store their .htpasswd files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage.

Patches

This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards.

Workarounds

User may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241

🎯 Affected products1

go/github.com/metal3-io/baremetal-operator:< 0.3.0

🔗 References (4)

https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m
https://github.com/metal3-io/baremetal-operator/pull/1241
https://nvd.nist.gov/vuln/detail/CVE-2023-30841
https://github.com/advisories/GHSA-9wh7-397j-722m