NULL Pointer Dereference

Summary

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Versions prior to 1.0.2 and 1.1.x prior to 1.1.5, there is a NULL Pointer Dereference vulnerability in the Omni Resource Service allows unauthenticated users to cause a server panic and Denial-of-Service (DoS) by sending empty 'create/update' resource requests through the API endpoints. The vulnerability exists in the "isSensitiveSpec" function which calls "grpcomni.CreateResource" without checking if the resource's metadata field is nil. When a resource is created with an empty Metadata field, the "CreateResource" function attempts to access "resource.Metadata.Version" causing a segmentation fault. This vulnerability is fixed in versions 1.1.5 and 1.0.2.