4 ms·

These seems overblown since because configuring your ingress controllers and annotating your pods is like "I copy and pasted bash | sudo" but controllers in k8s

These seems overblown since because configuring your ingress controllers and annotating your pods is like "I copy and pasted bash | sudo" but controllers in k8s are a totally insane pattern so I guess any of them could steal/do a lot of evil, really.

tptacek 2y ago
It's "overblown" because of these dumb CVSS scores that get attached to vulnerabilities as if they had any meaning at all (they do not). By itself, it's just a marginally interesting semi-remote vuln, effectively a privesc within a K8s deployment.
- mort96 2y ago
  Score 9.8 ought to mean, "this is almost the worst conceivable vulnerability".
  - more_corn 2y ago
    I certainly stopped what I was doing to go check. This is a badly overblown emergency which degrades everyone’s ability to properly respond to actual emergencies.
    - mort96 2y ago
      Yeah, and there have been a lot of these lately. The more nothing-burger 9.8+ severity vulnerabilities there are, the less space there is for communicating "this is actually a severe vulnerability and you need to pay attention". Heartbleed was a 7.5. The entire security community is constantly shouting "RED ALERT, THIS IS A MUCH MUCH WORSE VULNERABILITY THAN HEARTBLEED" and they're all just non-issues.
      - cjbprime 2y ago
        That's a CVSS issue. Heartbleed only affected Confidentiality, and CVSS rates scores on a triad of Confidentiality, Integrity, and Availability. RCE affects all three.
        mort96 2y ago
        That's exactly what I'm complaining about, yes. Nothing burgers get 9.8, while earth shattering vulnerabilities get 7.5 using the scoring system that the security community uses to describe "severity".
        tptacek 2y ago
        Heartbleed was a much more significant issue than this ingress-nginx thing.
        cjbprime 2y ago
        I agree with you, which is why I'm redirecting the blame to the CVSS standard, which does not agree with you.
  - rcconf 2y ago
    This is literally true, it is the worst conceivable vulnerability, total access to your k8s cluster by hitting a URL, how about a 10 instead of 9.8, these comments are wild.

tptacek 2y ago

It's "overblown" because of these dumb CVSS scores that get attached to vulnerabilities as if they had any meaning at all (they do not). By itself, it's just a marginally interesting semi-remote vuln, effectively a privesc within a K8s deployment.

mort96 2y ago
Score 9.8 ought to mean, "this is almost the worst conceivable vulnerability".
- more_corn 2y ago
  I certainly stopped what I was doing to go check. This is a badly overblown emergency which degrades everyone’s ability to properly respond to actual emergencies.
  - mort96 2y ago
    Yeah, and there have been a lot of these lately. The more nothing-burger 9.8+ severity vulnerabilities there are, the less space there is for communicating "this is actually a severe vulnerability and you need to pay attention". Heartbleed was a 7.5. The entire security community is constantly shouting "RED ALERT, THIS IS A MUCH MUCH WORSE VULNERABILITY THAN HEARTBLEED" and they're all just non-issues.
    - cjbprime 2y ago
      That's a CVSS issue. Heartbleed only affected Confidentiality, and CVSS rates scores on a triad of Confidentiality, Integrity, and Availability. RCE affects all three.
      - mort96 2y ago
        That's exactly what I'm complaining about, yes. Nothing burgers get 9.8, while earth shattering vulnerabilities get 7.5 using the scoring system that the security community uses to describe "severity".
      - tptacek 2y ago
        Heartbleed was a much more significant issue than this ingress-nginx thing.
        cjbprime 2y ago
        I agree with you, which is why I'm redirecting the blame to the CVSS standard, which does not agree with you.
- rcconf 2y ago
  This is literally true, it is the worst conceivable vulnerability, total access to your k8s cluster by hitting a URL, how about a 10 instead of 9.8, these comments are wild.