x/vulndb: potential Go vuln in github.com/kubean-io/kubean: GHSA-3wfj-3x8q-hrpg

[GoVulnBot]

Advisory GHSA-3wfj-3x8q-hrpg references a vulnerability in the following Go modules:

Module
github.com/kubean-io/kubean

Description:

Impact

This ClusterRole has * verbs of * resources. If a malicious user can access the worker node which has kubean's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a cluster-level privilege escalation.

Patches

>=v0.18.0

References

Reporting by @younaman(Nanzi Yang)
kubean-io/kubean#1326

References:

• ADVISORY: GHSA-3wfj-3x8q-hrpg
• ADVISORY: GHSA-3wfj-3x8q-hrpg
• FIX: kubean-io/kubean@167e973
• REPORT: software bug: too excessive clusterrole privilege kubean-io/kubean#1326

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/kubean-io/kubean
      versions:
        - fixed: 0.18.0
      vulnerable_at: 0.17.5
summary: Kubean vulnerable to cluster-level privilege escalation in github.com/kubean-io/kubean
cves:
    - CVE-2024-41820
ghsas:
    - GHSA-3wfj-3x8q-hrpg
references:
    - advisory: https://github.com/advisories/GHSA-3wfj-3x8q-hrpg
    - advisory: https://github.com/kubean-io/kubean/security/advisories/GHSA-3wfj-3x8q-hrpg
    - fix: https://github.com/kubean-io/kubean/commit/167e97329e4a27ba2f456d2846d39af20e1af7ef
    - report: https://github.com/kubean-io/kubean/issues/1326
source:
    id: GHSA-3wfj-3x8q-hrpg
    created: 2024-08-05T17:01:17.337017445Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/603235 mentions this issue: data/reports: add 29 unreviewed reports

[gopherbot]

Change https://go.dev/cl/606360 mentions this issue: data/reports: regenerate 8 reports