CVE-2023-30841
Description
Baremetal Operator (BMO) is a bare metal host provisioning integration for Kubernetes. Prior to version 0.3.0, ironic and ironic-inspector deployed within Baremetal Operator using the included `deploy.sh` store their `.htpasswd` files as ConfigMaps instead of Secrets. This causes the plain-text username and hashed password to be readable by anyone having a cluster-wide read-access to the management cluster, or access to the management cluster's Etcd storage. This issue is patched in baremetal-operator PR#1241, and is included in BMO release 0.3.0 onwards. As a workaround, users may modify the kustomizations and redeploy the BMO, or recreate the required ConfigMaps as Secrets per instructions in baremetal-operator PR#1241.
How to fix
- linuxfoundation baremetal_operator0.3.0 or later
- github.com/metal3-io/baremetal-operator0.3.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation baremetal_operator | v < 0.3.0 | 0.3.0 |
| github.com/metal3-io/baremetal-operatorGo | v < 0.3.0 | 0.3.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.