CVE-2024-42363 – GHSL-2023-136_Samson

https://notcve.org/view.php?id=CVE-2024-42363

20 Aug 2024 — Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parse_file method where it is unsafely deserialized using the YAML.load_stream method. This issue may lead to Remote Code Execution (RCE). This vulnerability is fixed in 3385. • https://securitylab.github.com/advisories/GHSL-2023-136_Samson • CWE-502: Deserialization of Untrusted Data •