{"id":111332,"date":"2023-11-06T09:10:14","date_gmt":"2023-11-06T07:10:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-ingress-nginx-pozvolyayushhie-skomprometirovat-klastery-kubernetes"},"modified":"2023-11-06T09:10:14","modified_gmt":"2023-11-06T07:10:14","slug":"uyazvimosti-v-ingress-nginx-pozvolyayushhie-skomprometirovat-klastery-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-ingress-nginx-pozvolyayushhie-skomprometirovat-klastery-kubernetes","title":{"rendered":"Ingress-nginx haavatavused, mis v\u00f5imaldavad Kubernetese klastreid kompromiteerida","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Arendatavas Kubernetese ingress-kontrolleris ingress-nginx on tuvastatud kolm haavatavust, mis v\u00f5imaldavad vaikeseadistuses ligip\u00e4\u00e4su Ingress objekti seadistustele, kus s\u00e4ilitatakse muu hulgas ka Kubernetese serverite juurdep\u00e4\u00e4suks vajalikud mandaadid, mis v\u00f5imaldavad privileege saada klastrisse. Probleemid ilmnevad ainult Kubernetese ingress-kontrolleris ingress-nginx ja ei puuduta kubernetes-ingress kontrollerit, mille arendavad NGINX arendajad. <\/p>\n

Ingress-kontroller toimib v\u00e4ravana ja seda kasutatakse Kuberneteses, et korraldada juurdep\u00e4\u00e4su v\u00e4lisest v\u00f5rgust klastris asuvatele teenustele. Ingress-nginx kontroller on k\u00f5ige populaarsem ja rakendab server<\/a> NGINX-i klastrisse suunatud p\u00e4ringute edastamiseks, v\u00e4liste p\u00e4ringute suunamiseks ja koormuse jaotamiseks. Kubernetese projekt pakub p\u00f5hihingeldusi AWS, GCE ja nginx jaoks, viimane neist ei ole kuidagi seotud kubernetes-ingress kontrolleri toetamisega, millega tegeleb F5 \/ NGINX.

\"Ingress-nginx<\/center> <\/p>\n

Haavatavused CVE-2023-5043 ja CVE-2023-5044 v\u00f5imaldavad jooksutada oma koodi serveris<\/a> processi ingress-kontrolleri \u00f5iguste m\u00e4\u00e4ramine, kasutades selle asendamiseks parameetreid «nginx.ingress.kubernetes.io\/configuration-snippet» ja «nginx.ingress.kubernetes.io\/permanent-redirect. Muuhulgas v\u00f5imaldavad saadud juurdep\u00e4\u00e4su\u00f5igused t\u00f5mmata v\u00e4lja autentimistokeni, mida kasutatakse klastrihalduse tasemel autentimiseks. Haavatavus CVE-2022-4886 v\u00f5imaldab m\u00f6\u00f6da minna failiteede kontrollist, kasutades direktiivi log_format. <\/p>\n

Kaks esimest haavatavust ilmnevad ainult ingress-nginx versioonides enne 1.9.0, samas kui viimane \u2014 enne versiooni 1.8.0. R\u00fcnnaku sooritamiseks peab r\u00fcndajal olema juurdep\u00e4\u00e4s ingress-objekti konfiguratsioonile, n\u00e4iteks mitme kasutaja Kubernetes klastrites, kus kasutajatel on v\u00f5imalus luua objekte oma nimede ruumis.
\n
Allikas: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Kubernetes ingress-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 ingress-nginx \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u0430 Ingress, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0438 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c Kubernetes, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0443. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u043f\u0440\u043e\u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u0432 ingress-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 ingress-nginx \u043e\u0442 \u043f\u0440\u043e\u0435\u043a\u0442\u0430 Kubernetes \u0438 \u043d\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440 kubernetes-ingress, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u044b\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c\u0438 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":111333,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-111332","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ingress-nginx haavatavused, mis v\u00f5imaldavad Kubernetese klastreid kompromiteerida | ProHoster","description":"Arendatavas Kubernetese ingress-kontrolleris ingress-nginx on tuvastatud kolm haavatavust, mis v\u00f5imaldavad vaikeseadistuses ligip\u00e4\u00e4su Ingress objekti seadistustele, kus s\u00e4ilitatakse samuti.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-ingress-nginx-pozvolyayushhie-skomprometirovat-klastery-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 ingress-nginx, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u044b Kubernetes | ProHoster","og:description":"\u0412 \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u0435\u043c\u043e\u043c \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c Kubernetes ingress-\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u0435 ingress-nginx \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u044b \u0442\u0440\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0432 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430\u043c \u043e\u0431\u044a\u0435\u043a\u0442\u0430 Ingress, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0445\u0440\u0430\u043d\u044f\u0442\u0441\u044f \u0438.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/uyazvimosti-v-ingress-nginx-pozvolyayushhie-skomprometirovat-klastery-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-11-06T07:10:14+00:00","article:modified_time":"2023-11-06T07:10:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"111332","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-09 21:39:54","updated":"2026-02-09 21:39:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111332","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=111332"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111332\/revisions"}],"predecessor-version":[{"id":173003,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/111332\/revisions\/173003"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/111333"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=111332"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=111332"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=111332"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}