Ssst0N3

An issue exists in the webhook delivery component that fails to properly validate target addresses, enabling Server-Side Request Forgery (SSRF). SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location. An authenticated user with ProjectAdmin permissions can configure a webhook policy targeting private or link-local IP ranges. When a project event occurs, the jobservice sends unauthenticated outbound HTTP POST requests to the specified target. If the target returns an error status, the response body is recorded in the webhook execution log, which is accessible to project members, potentially exposing cloud metadata or other network-restricted resources.

An input validation error exists where containers launched with a numeric `User` directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username. If a crafted image includes an `/etc/passwd` file that maps this large numeric string to root, the container runs as root (UID 0). This allows the Kubernetes `runAsNonRoot` restriction to be bypassed, affecting environments that require containers to run as a non-root user.

The issue is related to the incorrect handling of symbolic links before accessing a file, which allows an attacker to access confidential data, compromise its integrity, and cause a denial of service. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration.