Re:Kubernetes ingress-nginx controller vulnerability
by jeffbee on Friday October 22, 2021 @10:44AM
(#28957869)
You can check for this vulnerability using the existing tooling any k8s admin already has on their systems by necessity. It's always foolish to install unknown software and security professionals should never advise that.
[ Parent
| on HN ]
Re:Kubernetes ingress-nginx controller vulnerability
by tbrownaw on Friday October 22, 2021 @11:14AM
(#28958273)
> unknown software
Looking at the blog URL and header bar, and the script URL, this is pretty clearly a company blog recommending to use the company's own product. I hardly think that context counts as "unknown".
Re:Kubernetes ingress-nginx controller vulnerability
by justinclift on Friday October 22, 2021 @11:30AM
(#28958475)
Lets say (for example) that was published on a wordpress site, and the admins for whatever reason didn't secure it properly.
The article in question which _today_ looks all legit and points to a nice working script, might tomorrow be pointing to someone else's script that's a lot less legit.
And yes, in this imaginary scenario that wordpress install leads to a host of other problems for the company.
No need to make them your problems too though. ;)