ืืื ืื ืื ืืจืขืกืก-ื ืืื ืงืก ืงืึทื ืืจืึธืืืขืจ ืืขืืืขืืึธืคึผืขื ืืืจื ืื Kubernetes ืคึผืจืืืขืงื, ืืจืื ืืืึทืื ืขืจืึทืืืืืืื ืืึธืื ืฉืืื ืืืืขื ืึทืคืืื ืืืึธืก ืืึธืื, ืืื ืื ืคืขืืืงืืึทื ืงืึทื ืคืืืืขืจืืืฉืึทื, ืึทืงืกืขืก ืฆื ืื ืกืขืืืื ืืก ืคืื ืื Ingress ืืืืคืขืฅ, ืืืึธืก, ืฆืืืืฉื ืื ืืขืจืข ืืืื, ืกืืึธืจื ืงืจืึทืืขื ืืฉืึทืื ืคึฟืึทืจ ืึทืงืกืขืก Kubernetes ืกืขืจืืืขืจืก, ืึทืืึทืืื ื ืคึผืจืืืืืืืืฉื ืึทืงืกืขืก. ืฆื ืืขืจ ืงื ืืื. ืื ืคืจืืืืขืืขื ืืขืจืฉืืึทื ืขื ืืืืื ืืื ืื ืื ืืจืขืกืก-ื ืืื ืงืก ืงืึทื ืืจืึธืืืขืจ ืคึฟืื ืื Kubernetes ืคึผืจืืืขืงื ืืื ืืึธื ื ืื ืืืืจืงื ืื ืงืืืขืจื ืขืืขืก-ืื ืืจืขืกืก ืงืึธื ืืจืึธืืืขืจ ืืขืืืขืืึธืคึผืขื ืืืจื ืื NGINX ืืขืืืขืืึธืคึผืขืจืก.
ืื ืื ืืจืขืกืก ืงืึธื ืืจืึธืืืขืจ ืึทืงื ืืื ืึท ืืืืืืืื ืืื ืืื ืืขื ืืฆื ืืื Kubernetes ืฆื ืึธืจืืึทื ืืืืจื ืึทืงืกืขืก ืคึฟืื ืื ืคืื ืืจืืืกื ืืืง ื ืขืฅ ืฆื ืกืขืจืืืืกืขืก ืืื ืืขื ืงื ืืื. ืื ืื ืืจืขืกืก-ื ืืื ืงืก ืงืึธื ืืจืึธืืืขืจ ืืื ืื ืืขืจืกื ืคืึธืืงืก ืืื ื ืืฆื ืื NGINX ืกืขืจืืืขืจ ืฆื ืคืึธืจืืืก ืจืืงืืืขืก ืฆื ืื ืงื ืืื, ืืึทืจืฉืจืื ืคืื ืืจืืืกื ืืืง ืจืืงืืืขืก ืืื ืืึทืกืข ืืืึธื. ืื Kubernetes ืคึผืจืืืขืงื ืคึผืจืึธืืืืืขืก ืืึทืจืฅ ืื ืืจืขืกืก ืงืึทื ืืจืึธืืืขืจื ืคึฟืึทืจ AWS, GCE ืืื nginx, ืื ืืขืฆืืข ืคืื โโโโืืืึธืก ืืื ืืื ืงืืื ืืืขื ืฉืืึทืืืช ืฆื ืื ืงืืืขืจื ืขืืขืก ืื ืืจืขืกืก ืงืึธื ืืจืึธืืืขืจ ืืืื ืืืื ื ืืืจื F5 / NGINX.
ืืืึทืื ืขืจืึทืืืืืืื CVE-2023-5043 ืืื CVE-2023-5044 ืืึธืื ืืืจ ืฆื ืืืกืคืืจื ืืืื ืงืึธื ืืืืฃ ืื ืกืขืจืืืขืจ ืืื ืื ืจืขืื ืคืื ืื ืื ืืจืขืกืก ืงืึธื ืืจืึธืืืขืจ ืคึผืจืึธืฆืขืก, ื ืืฆื ืื "nginx.ingress.kubernetes.io/configuration-snippet" ืืื "nginx.ingress" .kubernetes" ืคึผืึทืจืึทืืขืืขืจืก ืฆื ืคืึทืจืืืึทืื ืขืก .io/permanent-redirect." ืฆืืืืฉื ืื ืืขืจืข ืืืื, ืื ืืืงืืืขื ืึทืงืกืขืก ืจืขืื ืืึธืื ืืืจ ืฆืืจืืงืงืจืืื ืึท ืกืืืขื ืืขื ืืฆื ืคึฟืึทืจ ืึธืืขื ืืึทืงืืืฉืึทื ืืืืฃ ืื ืงื ืืื ืคืึทืจืืืึทืืืื ื ืืืจืื. ืืืึทืื ืขืจืึทืืืืืื CVE-2022-4886 ืึทืืึทืื ืืืจ ืฆื ืืืืคึผืึทืก ืืขืงืข ืืจื ืืืขืจืึทืคืึทืงืืืฉืึทื ื ืืฆื ืื ืืึธื_ืคืึธืจืืึทื ืืืจืขืงืืืื.
ืื ืขืจืฉืืข ืฆืืืื ืืืึทืื ืขืจืึทืืืืืืื ืืขืจืฉืืึทื ืขื ืืืืื ืืื Ingress-nginx ืจืืืืกืื ืืืืืขืจ ืืืขืจืกืืข 1.9.0, ืืื ืื ืืขืฆืืข - ืืืืืขืจ ืืืขืจืกืืข 1.8.0. ืฆื ืืืจืืคืืจื ืึทื ืึทืืึทืง, ืึท ืึทืืึทืงืขืจ ืืืื ืืึธืื ืฆืืืจืื ืฆื ืื ืงืึทื ืคืืืืขืจืืืฉืึทื ืคืื ืื ืื ืืจืขืกืก ืืืืคืขืฅ, ืืืฉื, ืืื ืืึทืืื-ืืขื ืึทื ื Kubernetes ืงืืึทืกืืขืจื, ืืื ืืืึธืก ืื ืืืืขืจื ืืึธืื ืื ืคืืืืงืืื ืฆื ืฉืึทืคึฟื ืึทืืืืฉืขืงืฅ ืืื ืืืืขืจ ื ืึธืืขื.
ืืงืืจ: opennet.ru