x/vulndb: potential Go vuln in github.com/garden-io/garden: CVE-2023-44392

[GoVulnBot]

CVE-2023-44392 references github.com/garden-io/garden, which may be a Go module.

Description:
Garden provides automation for Kubernetes development and testing. Prior tov ersions 0.13.17 and 0.12.65, Garden has a dependency on the cryo library, which is vulnerable to code injection due to an insecure implementation of deserialization. Garden stores serialized objects using cryo in the Kubernetes ConfigMap resources prefixed with test-result and run-result to cache Garden test and run results. These ConfigMaps are stored either in the garden-system namespace or the configured user namespace. When a user invokes the command garden test or garden run objects stored in the ConfigMap are retrieved and deserialized. This can be used by an attacker with access to the Kubernetes cluster to store malicious objects in the ConfigMap, which can trigger a remote code execution on the users machine when cryo deserializes the object. In order to exploit this vulnerability, an attacker must have access to the Kubernetes cluster used to deploy garden remote environments. Further, a user must actively invoke either a garden test or garden run which has previously cached results. The issue has been patched in Garden versions 0.13.17 (Bonsai) and 0.12.65 (Acorn). Only Garden versions prior to these are vulnerable. No known workarounds are available.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-44392
• JSON: https://github.com/CVEProject/cvelist/tree/53a96dc94485751c0bc691f7181e11aa15002f91/2023/44xxx/CVE-2023-44392.json
• advisory: GHSA-hm75-6vc9-8rpr
• fix: garden-io/garden@3117964
• Imported by: https://pkg.go.dev/github.com/garden-io/garden?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/garden-io/garden
      vulnerable_at: 0.12.3
      packages:
        - package: garden
cves:
    - CVE-2023-44392
references:
    - advisory: https://github.com/garden-io/garden/security/advisories/GHSA-hm75-6vc9-8rpr
    - fix: https://github.com/garden-io/garden/commit/3117964da40d3114f129a6131b4ada89eaa4eb8c

[jba]

Also, it's a tool.

[gopherbot]

Change https://go.dev/cl/535696 mentions this issue: data/excluded: batch add 5 excluded reports