A security vulnerability may cause whole cluster been hijacked

[kaaass]

Hi community! I found a vulnerability in kured and reported it privately with respect to the security policy one week ago. I tried to send an email to the security mailing list, but I haven't received any response currently. This is not urging, I just wanted to ask if I haven't been successful in getting in touch with the maintainer (e.g. maybe the email is recognized as spam). I apologize if this issue has caused any trouble.

[ckotzbauer]

Hi @kaaass, we discussed your report internally last week, but due to the holiday season, we where not be able to answer your mail, we apologize. We already discussed a possible solution and will implement this in the next weeks. Thanks again for your report, we appreciate that!

[kaaass]

@ckotzbauer Thank you for the reply and the confirmation! May I ask if kured plans to disclose this vulnerability? For example, assigning a CVE. Vulnerability disclosure often helps users update to the latest version to reduce risk.

[ckotzbauer]

Sure, we will discuss this!

[github-actions[bot]]

This issue was automatically considered stale due to lack of activity. Please update it and/or join our slack channels to promote it, before it automatically closes (in 7 days).