GHSA-4fcw-pq4r-f4q7

Server-Side Request Forgery in Spinnaker Orca

Source: GitHub Advisory Database (reviewed) High CVE-2020-9298

Packages

Ecosystem	Package	Affected	Fixed in
Maven	com.netflix.spinnaker.orca:orca-core	< 8.7.0	8.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

The Spinnaker template resolution functionality is vulnerable to Server-Side Request Forgery (SSRF), which allows an attacker to send requests on behalf of Spinnaker potentially leading to sensitive data disclosure.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-9298 advisory
https://github.com/spinnaker/orca/pull/3706/commits/4f3c07da8fcacd67bb1984aef11b2066f2c0d11c web
https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-003.md web
https://github.com/spinnaker/orca/releases/tag/v8.7.0 web