Gardener: Authorization Bypass via Group Subject Injection

[ Description ]Official description

Gardener implements the automated management and operation of Kubernetes clusters as a service. Prior to 1.142.6, 1.143.3, 1.144.2, and 1.145.0, the customverbauthorizer admission plugin's mustCheckProjectMembers manage-members check compares changes to User subjects but does not account for Group or ServiceAccount subjects in Project.spec.members. A project administrator who lacks manage-members permission can add arbitrary Group or ServiceAccount subjects, including the system:authenticated Group, and thereby grant broad project access. The resulting access can include Shoots, Secrets, and cloud provider credentials. This issue is fixed in versions 1.142.6, 1.143.3, 1.144.2, and 1.145.0.

[ Fixes ]Fixes and patches

• github.com/gardener/gardener 1.142.6Fixed version · GitHub Advisories · go package github.com/gardener/gardener: upgrade to 1.142.6 or later (affected < 1.142.6)
• gardener/gardener 1.143.3Fixed version · GitHub Advisories · go package gardener/gardener: upgrade to 1.143.3 or later (affected >= 1.143.0, < 1.143.3)
• gardener/gardener 1.144.2Fixed version · GitHub Advisories · go package gardener/gardener: upgrade to 1.144.2 or later (affected >= 1.144.0, < 1.144.2)

[ Packages ]Affected open-source packages

• github.com/gardener/gardener goAffected < 1.142.6 · fixed in 1.142.6 · GHSA-gfjv-gqf2-c888
• gardener/gardener goAffected >= 1.143.0, < 1.143.3 · fixed in 1.143.3 · GHSA-gfjv-gqf2-c888
• gardener/gardener goAffected >= 1.144.0, < 1.144.2 · fixed in 1.144.2 · GHSA-gfjv-gqf2-c888

[ References ]References

• github.com/gardener/gardener/security/advisories/GHSA-gfjv-gqf2-c888x_refsource_CONFIRM
• github.com/gardener/gardener/pull/15080x_refsource_MISC
• github.com/gardener/gardener/commit/63751db97dca6cc5ee5f966d4963415de6ae5545x_refsource_MISC
• github.com/gardener/gardener/releases/tag/v1.144.2x_refsource_MISC