CVE-2024-40632— Linkerd 安全漏洞

Linkerd potential access to the shutdown endpoint

Linkerd is an open source, ultralight, security-first service mesh for Kubernetes. In affected versions when the application being run by linkerd is susceptible to SSRF, an attacker could potentially trigger a denial-of-service (DoS) attack by making requests to localhost:4191/shutdown. Linkerd could introduce an optional environment variable to control a token that must be passed as a header. Linkerd should reject shutdown requests that do not include this header. This issue has been addressed in release version edge-24.6.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

服务端请求伪造(SSRF)

Linkerd 安全漏洞

Linkerd是Linkerd开源的一个适用于 Kubernetes 的超轻量级、安全优先的服务网格。 Linkerd存在安全漏洞，该漏洞源于调用 shutdown 接口需要引入的令牌可以被绕过。

N/A

N/A