CVE-2023-30841 Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps
Baremetal Operator stores credentials in ConfigMaps, allowing cluster readers to access sensitive authentication data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-30841?
CVE-2023-30841 is a medium-severity vulnerability in metal3-io baremetal-operator, published on 26 Apr 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.
Which versions are affected by CVE-2023-30841?
2 open source packages ship an affected version, including github.com/metal3-io/baremetal-operator. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/metal3-io/baremetal-operator Go | All versions | 0.3.0 |
github.com/metal3-io/baremetal-operator Go | All versions | 0.3.0 |
Products include Linuxfoundation Baremetal Operator.
How do I fix CVE-2023-30841?
Upgrade github.com/metal3-io/baremetal-operator to 0.3.0 or later.
Is CVE-2023-30841 being exploited?
There is no known exploitation of CVE-2023-30841 in the wild and no public exploit code.
Sources
Also known as GHSA-9wh7-397j-722m.