erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: March 24, 2025

1 editorial brief, 1 known exploited (cisa kev) addition and 2 critical advisories.

All digests · RSS · Markdown

Take stock

  • Check exposure: IngressNightmare. Anyone running the Kubernetes community ingress-nginx controller older than v1.11.5 or v1.12.1 with the validating admission webhook enabled, especially if the webhook is reachable beyond the API server.
  • Do you run any of these? reviewdog action-setup GitHub Action. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-04-14.
  • Maven: 1 critical advisory (org.opendaylight.sfc:sfc-parent). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • Go: 1 critical advisory (k8s.io/ingress-nginx). Check with govulncheck ./....
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2025-1974, CVE-2025-1097

IngressNightmare: ingress-nginx Cluster Takeover RCE

Patched since March 2025. If any cluster still runs ingress-nginx below 1.11.5 or 1.12.1, that is a cluster-takeover risk, and the controller itself is now retired, so plan the migration while you check.

Must act: Anyone running the Kubernetes community ingress-nginx controller older than v1.11.5 or v1.12.1 with the validating admission webhook enabled, especially if the webhook is reachable beyond the API server.

Can relax: Clusters with no ingress-nginx pods (including those using F5/NGINX Inc.'s separate NGINX Ingress Controller or other controllers) and clusters already on 1.11.5, 1.12.1 or later.

  1. Find controllers: kubectl get pods --all-namespaces --selector app.kubernetes.io/name=ingress-nginx, and note the image tags.
  2. Upgrade to ingress-nginx v1.11.5, v1.12.1 or any later release.
  3. If you cannot upgrade, disable the validating admission webhook (Helm: controller.admissionWebhooks.enabled=false; manual: delete the ingress-nginx-admission ValidatingWebhookConfiguration and remove --validating-webhook), then re-enable it after upgrading.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2025-30154reviewdog action-setup GitHub Action
reviewdog/action-setup GitHub Action Embedded Malicious Code Vulnerability		2025-04-14

Critical advisories by ecosystem 2

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Go 1

Check: govulncheck ./...

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>