v1.16.1

Security

This release fixes a Profile namespace restriction bypass in addon-controller. Details are in the security advisory: GHSA-p45x-hwmp-fvrj.

A Profile is namespace-scoped and is meant to match clusters and reference resources only within its own namespace. addon-controller enforced this for most references, but not for the namespace of these three fields:

• spec.helmCharts[].valuesFrom[].namespace
• spec.patchesFrom[].namespace
• spec.templateResourceRefs[].resource.namespace

A user allowed to create Profiles in one namespace could point these fields at another namespace. addon-controller would then read the referenced ConfigMaps, Secrets and other resources from that namespace with its own permissions.

From this release, the namespace of these fields is always set to the Profile's namespace, like the other references of a Profile. ClusterProfile is not affected: it is cluster-scoped and administrator-managed, so cross-namespace references are by design.

Affected versions: >= 0.21.0, < 1.16.1
Patched version: v1.16.1

Upgrade notes

Upgrade to v1.16.1. Profiles that reference ConfigMaps, Secrets or resources in a namespace other than their own through the three fields above will stop resolving those references. Move the referenced resources to the Profile's namespace, or use a ClusterProfile if the cross-namespace reference is intended.

If you cannot upgrade yet:

• Limit who can create and update Profiles to trusted users.
• Review existing Profiles for entries in the three fields whose namespace differs from the Profile's.
• Optionally add an admission policy that rejects Profiles where any of those namespaces is set and differs from metadata.namespace.

Credits

Reported by Sathwik Yadlapati