CVE-2020-9301: High severity spinnaker orca vulnerability

Q: What is the vulnerability ID for this Spinnaker security vulnerability?

The vulnerability ID for this Spinnaker security vulnerability is CVE-2020-9301.

Q: What is the severity of CVE-2020-9301?

The severity of CVE-2020-9301 is high with a CVSS score of 8.8.

Q: Which versions of Spinnaker are affected by CVE-2020-9301?

All versions of Spinnaker prior to version 1.23.4, 1.22.4 or 1.21.5 are affected by CVE-2020-9301.

Q: How can an attacker exploit CVE-2020-9301?

An attacker can exploit CVE-2020-9301 by manipulating SpEL expressions to read and write arbitrary files within the orca container.

Q: How can I fix CVE-2020-9301?

To fix CVE-2020-9301, update Spinnaker to version 1.23.4, 1.22.4, or 1.21.5.

Published Dec 11, 2020

Updated

Nolan Ray from Apple Information Security identified a security vulnerability in Spinnaker, all versions prior to version 1.23.4, 1.22.4 or 1.21.5. The vulnerability exists within the handling of SpEL expressions that allows an attacker to read and write arbitrary files within the orca container via authenticated HTTP POST requests.

Affected Software

3 affected components

linuxfoundation Spinnaker<1.21.5

linuxfoundation Spinnaker>=1.22.0<1.22.4

linuxfoundation Spinnaker>=1.23.0<1.23.4

Remediation

Patch Available

https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-006.md

Event History

Dec 11, 2020

CVE Published

via MITRE·02:10 AM

Data Sourced

via MITRE·02:10 AM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this Spinnaker security vulnerability?

The vulnerability ID for this Spinnaker security vulnerability is CVE-2020-9301.

What is the severity of CVE-2020-9301?