deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-jr3w-9vfr-c746
Package: github.com/rancher/local-path-provisioner (GO)
Severity: CRITICAL (CVSS 9.9)
CWE: CWE-23: Relative Path Traversal
Vulnerable versions: < 0.0.34
Patched in: 0.0.34

Summary: Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern

Details:
### Impact

A malicious user can manipulate the [parameters.pathPattern](https://github.com/rancher/local-path-provisioner/blob/d4f71b4b03a321e9f54be00808e9de42b8bfd35a/provisioner.go#L381) to create PersistentVolumes in arbitrary locations on the host node, potentially overwriting sensitive files or gaining access to unintended directories.

Example:
```
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: >
      {"apiVersion":"storage.k8s.io/v1","kind":"StorageClass","metadata":{"annotations":{},"name":"local-path"},"provisioner":"rancher.io/local-path","reclaimPolicy":"Delete","volumeBindingMode":"WaitForFirstConsumer"}
    storageclass.kubernetes.io/is-default-class: 'true'
  name: local-path
provisioner: rancher.io/local-path
reclaimPolicy: Delete
parameters:
  pathPattern: "{{ .PVC.Namespace }}/{{ .PVC.Name }}/../../../../../etc/new-dir"
volumeBindingMode: WaitForFirstConsumer
Results in the PersistentVolume to target /etc/new-dir:
```
This produces a PersistentVolume that points to `/etc/new-dir`, instead of a path under the configured base directory.

Expected Behavior:
- Paths generated from pathPattern should always resolve under the configured base path.
- Relative path elements (e.g., ..) should be normalized or rejected.


### Patches

This vulnerability is addressed by validating and normalizing the `parameters.pathPattern` to ensure that generated PersistentVolume paths always resolve under the configured base directory. Any path traversal attempts using relative path elements are rejected, preventing PersistentVolumes from being created in arbitrary locations on the host node.

Previously, a malicious user could manipulate `pathPattern` to escape the base path and create volumes pointing to sensitive or unintended directories (for example, `/etc`), potentially overwriting host files or gaining unauthorized access.

With this fix, path patterns that resolve outside of the base directory are denied, and only safe, normalized paths under the configured base path are allowed.

Patched versions of local-path-provisioner include releases v0.0.34 (and later).

No patches are provided for earlier releases, as they do not include the necessary path validation and normalization logic.

### Workarounds

There are no workarounds for this issue. Users must upgrade to a patched version of local-path-provisioner to fully mitigate the vulnerability.

### References

There are any questions or comments about this advisory:

- Contact the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.
- Open an issue in the [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.
GitHub Security Advisory: GHSA-9h3p-52vh-959w
Package: k8s.io/ingress-nginx (GO)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 1.14.0, < 1.14.3
Patched in: 1.14.3

Summary: ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx

Details:
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
GitHub Security Advisory: GHSA-9h3p-52vh-959w
Package: k8s.io/ingress-nginx (GO)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 1.13.7
Patched in: 1.13.7

Summary: ingress-nginx's `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx

Details:
A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-method` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
GitHub Security Advisory: GHSA-2pf9-vr92-6h3v
Package: k8s.io/ingress-nginx (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 1.14.0, < 1.14.3
Patched in: 1.14.3

Summary: ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling 

Details:
A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx controller pod being killed or the node running out of memory.
GitHub Security Advisory: GHSA-2pf9-vr92-6h3v
Package: k8s.io/ingress-nginx (GO)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: < 1.13.7
Patched in: 1.13.7

Summary: ingress-nginx vulnerable to Allocation of Resources Without Limits or Throttling 

Details:
A security issue was discovered in ingress-nginx where the validating admission controller feature is subject to a denial of service condition. By sending large requests to the validating admission controller, an attacker can cause memory consumption, which may result in the ingress-nginx controller pod being killed or the node running out of memory.
GitHub Security Advisory: GHSA-4g2f-xcph-2335
Package: k8s.io/ingress-nginx (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: >= 1.14.0, < 1.14.3
Patched in: 1.14.3

Summary: ingress-nginx has Improper Check for Unusual or Exceptional Conditions

Details:
A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in the presence of a specific misconfiguration.

If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the `auth-url` annotation may be accessed even when authentication fails.

Note that the built-in custom-errors backend works correctly. Triggering this issue requires an administrator to specifically configure ingress-nginx with a broken external component.
GitHub Security Advisory: GHSA-4g2f-xcph-2335
Package: k8s.io/ingress-nginx (GO)
Severity: LOW (CVSS 3.1)
CWE: CWE-754: Improper Check for Unusual or Exceptional Conditions
Vulnerable versions: < 1.13.7
Patched in: 1.13.7

Summary: ingress-nginx has Improper Check for Unusual or Exceptional Conditions

Details:
A security issue was discovered in ingress-nginx where the protection afforded by the `auth-url` Ingress annotation may not be effective in the presence of a specific misconfiguration.

If the ingress-nginx controller is configured with a default custom-errors configuration that includes HTTP errors 401 or 403, and if the configured default custom-errors backend is defective and fails to respect the X-Code HTTP header, then an Ingress with the `auth-url` annotation may be accessed even when authentication fails.

Note that the built-in custom-errors backend works correctly. Triggering this issue requires an administrator to specifically configure ingress-nginx with a broken external component.
GitHub Security Advisory: GHSA-jx8c-56mg-h6vp
Package: k8s.io/ingress-nginx (GO)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 1.14.0, < 1.14.3
Patched in: 1.14.3

Summary: ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx

Details:
A security issue was discovered in ingress-nginx. Tthe `rules.http.paths.path` Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
GitHub Security Advisory: GHSA-jx8c-56mg-h6vp
Package: k8s.io/ingress-nginx (GO)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 1.13.7
Patched in: 1.13.7

Summary: ingress-nginx's `rules.http.paths.path` Ingress field can be used to inject configuration into nginx

Details:
A security issue was discovered in ingress-nginx. Tthe `rules.http.paths.path` Ingress field can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)
GitHub Security Advisory: GHSA-5mqx-rpxv-mvxj
Package: github.com/hashicorp/nomad (GO)
Severity: HIGH (CVSS 7.7)
CWE: CWE-610: Externally Controlled Reference to a Resource in Another Sphere
Vulnerable versions: < 1.8.2
Patched in: 1.8.2

Summary: HashiCorp Nomad is vulnerable to path escape through archive unpacking during migration

Details:
HashiCorp Nomad and Nomad Enterprise 1.6.12 up to 1.7.9, and 1.8.1 archive unpacking during migration is vulnerable to path escaping of the allocation directory. This vulnerability, CVE-2024-6717, is fixed in Nomad 1.6.13, 1.7.10, and 1.8.2.
GitHub Security Advisory: GHSA-2w4f-9fgg-q2v9
Package: chainguard.dev/melange (GO)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 0.14.0, < 0.40.3
Patched in: 0.40.3

Summary: melange has a path traversal in license-path which allows reading files outside workspace 

Details:
An attacker who can influence a melange configuration file (e.g., through pull request-driven CI or build-as-a-service scenarios) could read arbitrary files from the host system. The `LicensingInfos` function in `pkg/config/config.go` reads license files specified in `copyright[].license-path` without validating that paths remain within the workspace directory, allowing path traversal via `../` sequences. The contents of the traversed file are embedded into the generated SBOM as license text, enabling exfiltration of sensitive data through build artifacts.                                                                                                                                                                      
                                                                                                                                                                                        
  Fix: Merged in commit 2f95c9f4
                                                                                                                                                                                        
  Acknowledgements                                                                                                                                                                      
                                                                                                                                                                                        
melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.
GitHub Security Advisory: GHSA-rf4g-89h5-crcr
Package: chainguard.dev/melange (GO)
Severity: HIGH (CVSS 7.8)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 0.10.0, < 0.40.3
Patched in: 0.40.3

Summary: melange affected by potential host command execution via license-check YAML mode patch pipeline 

Details:
An attacker who can influence inputs to the patch pipeline could execute arbitrary shell commands on the build host. The patch pipeline in pkg/build/pipelines/patch.yaml embeds input-derived values (series paths, patch filenames, and numeric parameters) into shell scripts without proper quoting or validation, allowing shell metacharacters to break out of their intended context.                                                                                                                                                               
                                                                                                                                                                                        
The vulnerability affects the built-in patch pipeline which can be invoked through melange build and melange license-check operations. An attacker who can control patch-related inputs (e.g., through pull request-driven CI, build-as-a-service, or by influencing melange configurations) can inject shell metacharacters such as backticks, command substitutions  $(…), semicolons, pipes, or redirections to execute arbitrary commands with the privileges of the melange build process.                                                              

Fix: Fixed in [bd132535](https://github.com/chainguard-dev/melange/commit/bd132535cd9f57d4bd39d9ead[PII_REDACTED]af030) ,  Released in 0.40.3.
                                                                                                                                                                                 
Acknowledgements                                                                                                                                                                      
                                                                                                                                                                                        
melange thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.
GitHub Security Advisory: GHSA-f4w5-5xv9-85f6
Package: chainguard-dev/apko (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: > 0.14.8, < 1.1.0
Patched in: 1.1.0

Summary: apko affected by potential unbounded resource consumption in expandapk.ExpandApk on attacker-controlled .apk streams

Details:
An attacker who controls or compromises an APK repository used by apko could cause resource exhaustion on the build host. The ExpandApk function in pkg/apk/expandapk/expandapk.go expands .apk streams without enforcing decompression limits, allowing a malicious repository to serve a small, highly-compressed .apk that inflates into a large tar stream, consuming excessive disk space and CPU time, causing build failures or denial of service.                                                                                                                       
                                                                                                                                                                                             
**Fix**: Fixed in [2be3903](https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09). Released in 1.1.0.
                                                                                                                                                                                             
**Acknowledgements**                                                                                                                                                                            
                                                                                                                                                                                              
apko thanks Oleh Konko (@1seal) from 1seal for discovering and reporting this issue.
GitHub Security Advisory: GHSA-6p9p-q6wh-9j89
Package: chainguard.dev/apko (GO)
Severity: MODERATE (CVSS 5.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-770: Allocation of Resources Without Limits or Throttling
Vulnerable versions: >= 0.14.8, < 1.1.0
Patched in: 1.1.0

Summary: apko affected by unbounded resource consumption in expandapk.Split on attacker-controlled .apk streams 

Details:
`expandapk.Split` drains the first gzip stream of an APK archive via `io.Copy(io.Discard, gzi)` without explicit bounds. With an attacker-controlled input stream, this can force large gzip inflation work and lead to resource exhaustion (availability impact).                                                                                                                      
                                                                                                                                                                                              
The `Split` function reads the first tar header, then drains the remainder of the gzip stream by reading from the gzip reader directly without any maximum uncompressed byte limit or inflate-ratio cap. A caller that parses attacker-controlled APK streams may be forced to spend excessive CPU time inflating gzip data, leading to timeouts or process slowdown.             
                                                                                                                                                                                              
**Fix:** Fixed with [2be3903](https://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09), Released in v1.1.0.                                                  
                                                                                                                                                                                              
**Acknowledgements**                                                                                                                                                                        
                                                                                                                                                                                             
apko thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.
GitHub Security Advisory: GHSA-5g94-c2wx-8pxw
Package: chainguard.dev/apko (GO)
Severity: HIGH (CVSS 7.5)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), CWE-23: Relative Path Traversal
Vulnerable versions: >= 0.14.8, < 1.1.0
Patched in: 1.1.0

Summary: apko has a path traversal in apko dirFS which allows filesystem writes outside base

Details:
A Path Traversal vulnerability was discovered in apko's dirFS filesystem abstraction. An attacker who can supply a malicious APK package (e.g., via a compromised or typosquatted repository) could create directories or symlinks outside the intended installation root. The MkdirAll, Mkdir, and Symlink methods in pkg/apk/fs/rwosfs.go use filepath.Join() without validating that the resulting path stays within the base directory.

**Fix:** Fixed by [d8b7887](https://github.com/chainguard-dev/apko/commit/d8b7887a968a527791b3c591ae83928cb49a9f14). Merged into release. 

**Acknowledgements**                                                                                                                                                                        
                                                                                                                                                                                              
apko thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.
GitHub Security Advisory: GHSA-vqqr-rmpc-hhg2
Package: chainguard.dev/melange (GO)
Severity: HIGH (CVSS 7.9)
CWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 0.3.0, < 0.40.3
Patched in: 0.40.3

Summary: melange pipeline working-directory could allow command injection

Details:
An attacker who can provide build input values, but not modify pipeline definitions, could execute arbitrary shell commands if the pipeline uses `${{vars.*}}` or `${{inputs.*}}` substitutions in `working-directory`. The field is embedded into shell scripts without proper quote escaping.

**Fix:** Fixed with [e51ca30c](https://github.com/chainguard-dev/melange/commit/e51ca30cfb63178f5a86997d23d3fff0359fa6c8), Released. 

**Acknowledgements**

melange thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.
GitHub Security Advisory: GHSA-qxx2-7h4c-83f4
Package: chainguard.dev/melange (GO)
Severity: HIGH (CVSS 8.2)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: >= 0.11.3, < 0.40.3
Patched in: 0.40.3

Summary: melange QEMU runner could write files outside workspace directory

Details:
An attacker who can influence the tar stream from a QEMU guest VM could write files outside the intended workspace directory on the host. The `retrieveWorkspace` function extracts tar entries without validating that paths stay within the workspace, allowing Path Traversal via `../` sequences.

**Fix:** Fixed in [6e243d0d](https://github.com/chainguard-dev/melange/commit/6e243d0d46699f837d7c392397a694d2bcc7612b). Merged in release.

**Acknowledgements**

melange thanks Oleh Konko from [1seal](https://1seal.org/) for discovering and reporting this issue.
GitHub Security Advisory: GHSA-gx3x-vq4p-mhhv
Package: github.com/cert-manager/cert-manager (GO)
Severity: MODERATE (CVSS 5.9)
CWE: CWE-129: Improper Validation of Array Index, CWE-704: Incorrect Type Conversion or Cast
Vulnerable versions: >= 1.19.0, < 1.19.3
Patched in: 1.19.3

Summary: cert-manager-controller DoS via Specially Crafted DNS Response

Details:
### Impact

The cert-manager-controller performs DNS lookups during ACME DNS-01 processing (for zone discovery and propagation self-checks). By default, these lookups use standard unencrypted DNS.

An attacker who can intercept and modify DNS traffic from the cert-manager-controller pod can insert a crafted entry into cert-manager's DNS cache. Accessing this entry will trigger a panic, resulting in Denial of Service (DoS) of the cert-manager controller.

The issue can also be exploited if the authoritative DNS server for the domain being validated is controlled by a malicious actor.

### Patches

The vulnerability was introduced in cert-manager v1.18.0 and has been patched in cert-manager v1.19.3 and v1.18.5, which are the supported minor releases at the time of publishing.

cert-manager versions prior to v1.18.0 are unaffected.

### Workarounds

- Using DNS-over-HTTPS reduces the risk of DNS traffic being intercepted and modified.
    - Note that DNS-over-HTTPS does *not* prevent the risk of an attacker-controlled authoritative DNS server.

### Resources

- Fix for cert-manager 1.18: https://github.com/cert-manager/cert-manager/pull/8467
- Fix for cert-manager 1.19: https://github.com/cert-manager/cert-manager/pull/8468
- Fix for master branch: https://github.com/cert-manager/cert-manager/pull/8469

### Credits

Huge thanks to Oleh Konko (@1seal) for reporting the issue, providing a detailed PoC and an initial patch!