x/vulndb: potential Go vuln in github.com/karmada-io/karmada: GHSA-cwrh-575j-8vr3

[GoVulnBot]

Advisory GHSA-cwrh-575j-8vr3 references a vulnerability in the following Go modules:

Module
github.com/karmada-io/karmada

Description:

Impact

What kind of vulnerability is it? Who is impacted?

Both in karmadactl and karmada-operator, it is possible to supply a filesystem path, or an HTTP(s) URL to retrieve the custom resource definitions(CRDs) needed by karmada. The CRDs are downloaded as a gzipped tarfile and are vulnerable to a TarSlip vulnerability. An attacker able to supply a malicious CRD file into a karmada initialization could write arbitrary files in arbitrary paths of the filesystem.

Patches

Has the problem been patched? What versions should users upgrade to?

From karmada version v1.12.0, when process...

References:

• ADVISORY: GHSA-cwrh-575j-8vr3
• ADVISORY: GHSA-cwrh-575j-8vr3
• FIX: karmada-io/karmada@40ec488
• FIX: karmada-io/karmada@f78e7e2
• FIX: karmada-operator: add CRDs archive verification to enhance file system robustness karmada-io/karmada#5703
• FIX: karmadactl init: add CRDs archive verification to enhance file system robustness karmada-io/karmada#5713

Cross references:

• github.com/karmada-io/karmada appears in 2 other report(s):
  • data/reports/GO-2024-2441.yaml (x/vulndb: potential Go vuln in github.com/karmada-io/karmada: GHSA-7xg2-83f8-39mr #2441)
  • data/reports/GO-2024-2817.yaml (x/vulndb: potential Go vuln in github.com/karmada-io/karmada: GHSA-wccg-v638-j9q2 #2817)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/karmada-io/karmada
      versions:
        - fixed: 1.12.0
      vulnerable_at: 1.12.0-beta.0
summary: Karmada Tar Slips in CRDs archive extraction in github.com/karmada-io/karmada
cves:
    - CVE-2024-56514
ghsas:
    - GHSA-cwrh-575j-8vr3
references:
    - advisory: https://github.com/advisories/GHSA-cwrh-575j-8vr3
    - advisory: https://github.com/karmada-io/karmada/security/advisories/GHSA-cwrh-575j-8vr3
    - fix: https://github.com/karmada-io/karmada/commit/40ec488b18a461ab0f871d2c9ec8665b361f0d50
    - fix: https://github.com/karmada-io/karmada/commit/f78e7e2a3d02bed04e9bc7abd3ae7b3ac56862d2
    - fix: https://github.com/karmada-io/karmada/pull/5703
    - fix: https://github.com/karmada-io/karmada/pull/5713
source:
    id: GHSA-cwrh-575j-8vr3
    created: 2025-01-03T17:01:19.552865497Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/640916 mentions this issue: data/reports: add 10 unreviewed reports