Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Credential exposure when running third-party builders in knative/func
Vulnerability Description
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious `lifecycle` container. This issues has been patched in PR #1442, and is part of release 1.8.1. This issue only affects users who are using function buildpacks from third-parties; pinning the builder image to a specific content-hash with a valid `lifecycle` image will also mitigate the attack.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
Vulnerability Type
信息暴露
Vulnerability Title
Func 信息泄露漏洞
Vulnerability Description
Func是Knative开源的一个客户端库和 CLI ，支持功能的开发和部署。 Func 1.8.0版本及之前版本存在信息泄露漏洞。攻击者利用该漏洞导致注册表凭据或本地docker暴露。
CVSS Information
N/A
Vulnerability Type
N/A