VDB

GHSA-823x-fv5p-h7hw

GHSA-823x-fv5p-h7hw PUBLISHED CVSS 8.800000190734863 HIGH

Record from GitHub Advisory Database · Published March 25, 2025

k8s.io/ingress-nginx is fixed in 1.12.1 and 1.11.5 (Go Modules)

ngress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
k8s.io/ingress-nginxGo Modules1.12.1, 1.11.5
ingress-nginx-controller-1.11Chainguard1.11.5-r0
ingress-nginx-controller-1.12Chainguard1.12.1-r14
ingress-nginx-controller-1.14Wolfi1.14.5-r16
ingress-nginx-controller-fips-1.14Chainguard1.14.5-r12
ingress-nginx-controller-fips-1.11Chainguard1.11.5-r0
ingress-nginx-controller-1.12Wolfi1.12.1-r14
ingress-nginx-controller-1.13Chainguard1.13.9-r14
ingress-nginx-controller-fips-1.13Chainguard1.13.9-r12
ingress-nginx-controller-1.14Chainguard1.14.5-r16
ingress-nginx-controller-1.11Wolfi1.11.5-r0
ingress-nginx-controller-fips-1.12Chainguard1.12.1-r0

Risk scores

CVSS 3.1
8.800000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

VendorProductVersions
chainguardingress-nginx-controller-1.110
chainguardingress-nginx-controller-fips-1.15*
chainguardingress-nginx-controller-1.120
chainguardingress-nginx-controller-1.15*
wolfiingress-nginx-controller-1.140
wolfiingress-nginx-controller-1.10*
chainguardingress-nginx-controller-fips-1.140
chainguardingress-nginx-controller-fips-1.110
chainguardingress-nginx-controller-fips-1.10*
wolfiingress-nginx-controller-1.120
chainguardingress-nginx-controller-1.10*
chainguardingress-nginx-controller-1.130
chainguardingress-nginx-controller-fips-1.130
chainguardingress-nginx-controller-1.140
wolfiingress-nginx-controller-1.110
wolfiingress-nginx-controller-1.15*
k8s.ioingress-nginx1.12.0-beta.0, 0
chainguardingress-nginx-controller-fips-1.120

Timeline

  • Mar 25, 2025 CVE Published
  • Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-823x-fv5p-h7hw
vulnetix vdb fixes GHSA-823x-fv5p-h7hw

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-823x-fv5p-h7hw/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›