GHSA-cq2g-pw6q-hf7j

Source

https://github.com/advisories/GHSA-cq2g-pw6q-hf7j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/12/GHSA-cq2g-pw6q-hf7j/GHSA-cq2g-pw6q-hf7j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cq2g-pw6q-hf7j

Aliases

Published

2022-12-19T21:09:05Z

Modified

2023-11-08T04:08:21.294648Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Cortex's Alertmanager can expose local files content via specially crafted config

Details

Impact

A local file inclusion vulnerability exists in Cortex versions v1.13.0, v1.13.1 and v1.14.0, where a malicious actor could remotely read local files as a result of parsing maliciously crafted Alertmanager configurations when submitted to the Alertmanager Set Configuration API. Only users of the Cortex Alertmanager service using -experimental.alertmanager.enable-api or enable_api: true are affected.

Specific Go Packages Affected

github.com/cortexproject/cortex/pkg/alertmanager

Patches

Affected Cortex users are advised to upgrade to versions 1.13.2 or 1.14.1.

Workarounds

Patching is ultimately advised. Using out-of-bound validation, Cortex administrators may reject Alertmanager configurations containing the api_key_file setting in the opsgenie_configs section and opsgenie_api_key_file in the global section before sending to the Set Alertmanager Configuration API as a workaround.

References

Fixed Versions:
- https://github.com/cortexproject/cortex/releases/tag/v1.14.1
- https://github.com/cortexproject/cortex/releases/tag/v1.13.2
https://cortexmetrics.io/docs/api/#set-alertmanager-configuration

For more information

If you have any questions or comments about this advisory:

Open an issue in cortex
Email us at cortex-team@googlegroups.com.

Database specific

{
    "nvd_published_at": "2022-12-19T22:15:00Z",
    "cwe_ids": [
        "CWE-184",
        "CWE-641",
        "CWE-73"
    ],
    "github_reviewed_at": "2022-12-19T21:09:05Z",
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

Go / github.com/cortexproject/cortex

Package

Name: github.com/cortexproject/cortex; View open source insights on deps.dev
Purl: pkg:golang/github.com/cortexproject/cortex

Affected ranges

Type: SEMVER
Events: Introduced

1.14.0

Fixed

1.14.1

Affected versions

1.*

1.14.0

Go / github.com/cortexproject/cortex

Package

Name: github.com/cortexproject/cortex; View open source insights on deps.dev
Purl: pkg:golang/github.com/cortexproject/cortex

Affected ranges

Type: SEMVER
Events: Introduced

1.13.0

Fixed

1.13.2