Ironic and ironic-inspector may expose as ConfigMaps
Moderate severity
GitHub Reviewed
Published
Apr 26, 2023
in
metal3-io/baremetal-operator
•
Updated Nov 7, 2023
Package
Affected versions
< 0.3.0
Patched versions
0.3.0
Description
Published by the National Vulnerability Database
Apr 26, 2023
Published to the GitHub Advisory Database
Apr 26, 2023
Reviewed
Apr 26, 2023
Last updated
Nov 7, 2023
Impact
Ironic and ironic-inspector deployed within Baremetal Operator using the included
deploy.shstore their.htpasswdfiles as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage.Patches
This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards.
Workarounds
User may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241
References