x/vulndb: potential Go vuln in github.com/carina-io/carina: CVE-2024-32359

[GoVulnBot]

CVE-2024-32359 references github.com/carina-io/carina, which may be a Go module.

Description:
An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtain the secrets of the entire cluster and further take over the cluster.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2024-32359
• JSON: https://github.com/CVEProject/cvelist/tree/2e344002c6ccecc97740b7257ad73905f1942152/2024/32xxx/CVE-2024-32359.json
• web: http://carina.com
• web: https://github.com/HouqiyuA/k8s-rbac-poc
• web: https://github.com/carina-io/carina
• web: https://gist.github.com/HouqiyuA/568d9857dab4ddba6b8b6a791e90f906
• Imported by: https://pkg.go.dev/github.com/carina-io/carina?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/carina-io/carina
      vulnerable_at: 0.13.0
      packages:
        - package: n/a
summary: CVE-2024-32359 in github.com/carina-io/carina
cves:
    - CVE-2024-32359
references:
    - web: http://carina.com
    - web: https://github.com/HouqiyuA/k8s-rbac-poc
    - web: https://github.com/carina-io/carina
    - web: https://gist.github.com/HouqiyuA/568d9857dab4ddba6b8b6a791e90f906
source:
    id: CVE-2024-32359