【中危】Steeltoe.Configuration.Abstractions 安全更新（GHSA-rxrh-4j9h-xgg9）

安全情报快照 · 风险级别：中危 · CVSS：4.7 · CVE-2026-50267 · GHSA-rxrh-4j9h-xgg9

先看结论

Steeltoe.Configuration.Abstractions存在安全风险，>= 4.0.0, <= 4.1.0 受影响，建议升级至 4.2.0。

影响范围

生态	组件	受影响版本	首个修复版本
nuget	`Steeltoe.Configuration.Abstractions`	>= 4.0.0, <= 4.1.0	4.2.0

处置建议

优先将 Steeltoe.Configuration.Abstractions 升级至 4.2.0 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Summary

When MySQL or PostgreSQL service bindings from VCAP_SERVICES include TLS client credentials, the Connectors library writes those credentials to temporary files in Path.GetTempPath() using File.CreateText. On Linux, File.CreateText creates files with mode 0644 (world-readable) under the process umask, and the files are never deleted. The same key material is protected at mode 0400 in /proc/<pid>/environ.

Impact

Any process co-located in the container that runs as a different UID can read the TLS client private key from /tmp and use it to impersonate the application when connecting to the backing database over mutual TLS.

Affected configuration

Application is deployed on Cloud Foundry or another environment that populates VCAP_SERVICES with a MySQL or PostgreSQL service binding that includes sslKey credentials.
A process running as a different UID shares the container's filesystem.

Mitigations

If an immediate upgrade is not possible, prevent other processes from running in the container under a different UID with access to /tmp.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。