Skip to content

Commit 4164cd3

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-c8g6-qrwh-m3vp GHSA-h773-7gf7-9m2x GHSA-qqj3-g7mx-5p4w
1 parent 1d7e548 commit 4164cd3

File tree

3 files changed

+289
-0
lines changed

3 files changed

+289
-0
lines changed

‎advisories/github-reviewed/2025/10/GHSA-c8g6-qrwh-m3vp/GHSA-c8g6-qrwh-m3vp.json‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c8g6-qrwh-m3vp",
4+
"modified": "2025-10-21T20:25:11Z",
5+
"published": "2025-10-21T20:25:11Z",
6+
"aliases": [
7+
"CVE-2025-54469"
8+
],
9+
"summary": "NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow",
10+
"details": "### Impact\nA vulnerability was identified in NeuVector, where the enforcer used environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` to generate a command to be executed via `popen`, without first sanitising their values.\n\nThe entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the `popen` function to execute a shell command that determines whether the ports used by the consul subprocess are still active.\n\nThe values of environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` are used directly to compose shell commands via popen without validation or sanitization. This behavior could allow a malicious user to inject malicious commands through these variables within the enforcer container.\n\nIn the patched version, the monitor process validates the values of `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` to ensure they contain only valid port numbers before invoking the `popen` command.\n\nIf validation fails, the monitor process exits immediately, causing the enforcer container to terminate. This prevents the execution of any injected or malicious commands.\n\n\n### Patches\nPatched versions include release `v5.4.7` and above.\n\n### Workarounds\nThere is no workaround for this issue. Users are recommended to upgrade, as soon as possible, to a version of NeuVector that contains the fix.\n\n### References\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/neuvector/neuvector"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "5.3.0"
29+
},
30+
{
31+
"fixed": "5.3.5"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "github.com/neuvector/neuvector"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "5.4.0"
48+
},
49+
{
50+
"fixed": "5.4.7"
51+
}
52+
]
53+
}
54+
],
55+
"database_specific": {
56+
"last_known_affected_version_range": "<= 5.4.6"
57+
}
58+
},
59+
{
60+
"package": {
61+
"ecosystem": "Go",
62+
"name": "github.com/neuvector/neuvector"
63+
},
64+
"ranges": [
65+
{
66+
"type": "ECOSYSTEM",
67+
"events": [
68+
{
69+
"introduced": "0.0.0-20230727023453-1c4957d53911"
70+
},
71+
{
72+
"fixed": "0.0.0-20251020133207-084a437033b4"
73+
}
74+
]
75+
}
76+
]
77+
}
78+
],
79+
"references": [
80+
{
81+
"type": "WEB",
82+
"url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-c8g6-qrwh-m3vp"
83+
},
84+
{
85+
"type": "PACKAGE",
86+
"url": "https://github.com/neuvector/neuvector"
87+
}
88+
],
89+
"database_specific": {
90+
"cwe_ids": [
91+
"CWE-120",
92+
"CWE-77"
93+
],
94+
"severity": "CRITICAL",
95+
"github_reviewed": true,
96+
"github_reviewed_at": "2025-10-21T20:25:11Z",
97+
"nvd_published_at": null
98+
}
99+
}

‎advisories/github-reviewed/2025/10/GHSA-h773-7gf7-9m2x/GHSA-h773-7gf7-9m2x.json‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-h773-7gf7-9m2x",
4+
"modified": "2025-10-21T20:26:25Z",
5+
"published": "2025-10-21T20:26:25Z",
6+
"aliases": [
7+
"CVE-2025-54471"
8+
],
9+
"summary": "NeuVector is shipping cryptographic material into its binary",
10+
"details": "### Impact\nNeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data.\n\nIn the patched version, NeuVector leverages the Kubernetes secret `neuvector-store-secret` in `neuvector` namespace to dynamically generate cryptographically secure random keys. This approach removes the reliance on static key values and ensures that encryption keys are managed securely within Kubernetes.\n\nDuring rolling upgrade or restoring from persistent storage, the NeuVector controller checks each encrypted configured field. If a sensitive field in the configuration is found to be encrypted by the default encryption key, it’s decrypted with the default encryption key and then re-encrypted with the new dynamic encryption key.\n\nIf the NeuVector controller does not have the correct RBAC for accessing the new secret, it writes this error log : \n`Required Kubernetes RBAC for secrets are not found` and exits.\n\nThe device encryption key is rotated every 3 months. For details, please refer to this [Rotating Self-Signed Certificate](https://open-docs.neuvector.com/configuration/console/certrotate) documentation.\n\n### Patches\nPatched versions include release **v5.4.7** and above.\n\n### Workarounds\nThere is no workaround for this issue. Users are recommended to upgrade, as soon as possible, to a version of NeuVector that contains the fix.\n\n### References\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "github.com/neuvector/neuvector"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "5.3.0"
29+
},
30+
{
31+
"fixed": "5.4.7"
32+
}
33+
]
34+
}
35+
],
36+
"database_specific": {
37+
"last_known_affected_version_range": "<= 5.4.6"
38+
}
39+
},
40+
{
41+
"package": {
42+
"ecosystem": "Go",
43+
"name": "github.com/neuvector/neuvector"
44+
},
45+
"ranges": [
46+
{
47+
"type": "ECOSYSTEM",
48+
"events": [
49+
{
50+
"introduced": "0.0.0-20230727023453-1c4957d53911"
51+
},
52+
{
53+
"fixed": "0.0.0-20251020133207-084a437033b4"
54+
}
55+
]
56+
}
57+
]
58+
}
59+
],
60+
"references": [
61+
{
62+
"type": "WEB",
63+
"url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-h773-7gf7-9m2x"
64+
},
65+
{
66+
"type": "WEB",
67+
"url": "https://github.com/neuvector/neuvector/commit/084a437033b491eeea11bdba1a09dd84ed12ea88"
68+
},
69+
{
70+
"type": "PACKAGE",
71+
"url": "https://github.com/neuvector/neuvector"
72+
}
73+
],
74+
"database_specific": {
75+
"cwe_ids": [
76+
"CWE-321"
77+
],
78+
"severity": "MODERATE",
79+
"github_reviewed": true,
80+
"github_reviewed_at": "2025-10-21T20:26:25Z",
81+
"nvd_published_at": null
82+
}
83+
}

‎advisories/github-reviewed/2025/10/GHSA-qqj3-g7mx-5p4w/GHSA-qqj3-g7mx-5p4w.json‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-qqj3-g7mx-5p4w",
4+
"modified": "2025-10-21T20:25:21Z",
5+
"published": "2025-10-21T20:25:21Z",
6+
"aliases": [
7+
"CVE-2025-54470"
8+
],
9+
"summary": "NeuVector telemetry sender is vulnerable to MITM and DoS",
10+
"details": "### Impact\nThis vulnerability affects NeuVector deployments only when the `Report anonymous cluster data option` is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server at `https://upgrades.neuvector-upgrade-responder.livestock.rancher.io`.\n\nIn affected versions, NeuVector does not enforce TLS certificate verification when transmitting anonymous cluster data to the telemetry server. As a result, the communication channel is susceptible to man-in-the-middle (MITM) attacks, where an attacker could intercept or modify the transmitted data. Additionally, NeuVector loads the response of the telemetry server is loaded into memory without size limitation, which makes it vulnerable to a Denial of Service(DoS) attack. \n\nThe patched version includes the following security improvements:\n- NeuVector now verifies the telemetry server’s `TLS certificate chain` and `hostname` during the handshake process. This ensures that all telemetry communications occur over a trusted and verified channel.\n- NeuVector limits the telemetry server’s response to `256 bytes`, mitigating the risk of memory exhaustion and DoS attacks.\n\nThese security enhancements are enabled by default and require no user action.\n\n\n### Patches\nPatched versions include release **v5.4.7** and above.\n\n### Workarounds\nIf you cannot update to a patched version, you can temporarily disable the Report anonymous cluster data, which is enabled by default in NeuVector.\nTo change this setting, go to **Settings** → **Configuration** → **Report anonymous cluster data** in the NeuVector UI.\n\nDisabling this option prevents NeuVector from sending telemetry data to the telemetry server, which helps mitigate this vulnerability.\n\n\n### References\nIf you have any questions or comments about this advisory:\n- Reach out to the [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n- Open an issue in the [NeuVector](https://github.com/neuvector/neuvector/issues/new/choose) repository.\n- Verify with our [support matrix](https://www.suse.com/suse-neuvector/support-matrix/all-supported-versions/neuvector-v-all-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/#suse-security).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "https://github.com/neuvector/neuvector"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "5.3.0"
29+
},
30+
{
31+
"fixed": "5.3.5"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Go",
40+
"name": "https://github.com/neuvector/neuvector"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "5.4.0"
48+
},
49+
{
50+
"fixed": "5.4.7"
51+
}
52+
]
53+
}
54+
],
55+
"database_specific": {
56+
"last_known_affected_version_range": "<= 5.4.6"
57+
}
58+
},
59+
{
60+
"package": {
61+
"ecosystem": "Go",
62+
"name": "https://github.com/neuvector/neuvector"
63+
},
64+
"ranges": [
65+
{
66+
"type": "ECOSYSTEM",
67+
"events": [
68+
{
69+
"introduced": "0.0.0-20230727023453-1c4957d53911"
70+
},
71+
{
72+
"fixed": "0.0.0-20251020133207-084a437033b4"
73+
}
74+
]
75+
}
76+
]
77+
}
78+
],
79+
"references": [
80+
{
81+
"type": "WEB",
82+
"url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-qqj3-g7mx-5p4w"
83+
},
84+
{
85+
"type": "WEB",
86+
"url": "https://github.com/neuvector/neuvector/commit/06424701e69bf1eb76ff90180d78853fded93021"
87+
},
88+
{
89+
"type": "WEB",
90+
"url": "https://github.com/neuvector/neuvector/commit/415737cbec581a5dc5f204fac1c78b7f29ad7dc2"
91+
},
92+
{
93+
"type": "PACKAGE",
94+
"url": "https://github.com/neuvector/neuvector"
95+
}
96+
],
97+
"database_specific": {
98+
"cwe_ids": [
99+
"CWE-295",
100+
"CWE-770"
101+
],
102+
"severity": "HIGH",
103+
"github_reviewed": true,
104+
"github_reviewed_at": "2025-10-21T20:25:21Z",
105+
"nvd_published_at": null
106+
}
107+
}

0 commit comments

Comments
 (0)