zendesk/samson

Releases3.3K

Frequency1 day 6 hours

Last Release 10 months ago

Stars1.44K

Web interface for deployments, with plugin architecture and kubernetes support

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-42363 ↗	Aug 20, 2024Tuesday, 20 August 2024, 21:15	8.8 HIGH	—
Prior to 3385, the user-controlled role parameter enters the application in the Kubernetes::RoleVerificationsController. The role parameter flows into the RoleConfigFile initializer and then into the Kubernetes::Util.parse_file method where it is unsafely deserialized using the YAML.load_stream method. This issue may lead to Remote Code Execution (RCE). This vulnerability is fixed in 3385.