GHSA-m5xf-x7q6-3rm7
KubeVela VelaUX APIserver has SSRF vulnerability
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/oam-dev/kubevela | >= 1.6.0-alpha.1, < 1.6.2 | 1.6.2 |
| Go | github.com/oam-dev/kubevela | < 1.5.9 | 1.5.9 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Users using the VelaUX APIServer could be affected by this vulnerability.
When using Helm Chart as the component delivery method, the request address of the warehouse is not restricted, and there is a blind SSRF vulnerability.
This issue is patched in 1.5.9 and 1.6.2.
### References
Fix by: #5000
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [KubeVela repo](https://github.com/kubevela/kubevela)
* Email us at [here](https://github.com/kubevela/kubevela#contact-us)
References
External links from the advisory. They lead to third-party sites.