x/vulndb: potential Go vuln in github.com/metal3-io/baremetal-operator: CVE-2023-30841

[GoVulnBot]

CVE-2023-30841 references github.com/metal3-io/baremetal-operator, which may be a Go module.

Description:
Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included deploy.sh store their .htpasswd files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-30841
• JSON: https://github.com/CVEProject/cvelist/tree/d720933b8ae1ca5e7dc217719b870ec6bff7e91c/2023/30xxx/CVE-2023-30841.json
• advisory: GHSA-9wh7-397j-722m
• fix: ⚠️ Store htpasswd files in Secrets instead of ConfigMaps metal3-io/baremetal-operator#1241
• Imported by: https://pkg.go.dev/github.com/metal3-io/baremetal-operator?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/metal3-io/baremetal-operator
    packages:
      - package: baremetal-operator
description: |
    Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.
cves:
  - CVE-2023-30841
references:
  - advisory: https://github.com/metal3-io/baremetal-operator/security/advisories/GHSA-9wh7-397j-722m
  - fix: https://github.com/metal3-io/baremetal-operator/pull/1241

[tuminoid]

BMO issue is not in the Go code, but in the deploy script and manifests. Hence the advisory is classified as Other and not Go.

[gopherbot]

Change https://go.dev/cl/492275 mentions this issue: data/excluded: batch add GO-2023-1745, GO-2023-1746