Fission framework vulnerabilities

Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. In versions prior to 1.24.0, a user with appropriate RBAC permissions could run privileged containers, leading to container-sandbox escape and access to the host's filesystem and network.

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications. In versions prior to 1.24.0, the Fission Function spec did not validate the namespace for Package reference, which could lead to unauthorized access.

Fission, a serverless framework for Kubernetes, prior to version 1.23.0, created runtime pods with ServiceAccountName: fission-fetcher, which had permissions to read secrets and configmaps across the entire namespace. This allowed user-supplied function code to access the Kubernetes API token, enabling it to read any secrets or configmaps in the function's namespace.