CVE-2022-0759
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.94%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.94% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-295
- Affected
- redhat/kubeclient
- Source
- secalert@redhat.com
References
- https://github.com/ManageIQ/kubeclient/issues/554Issue Tracking, Patch, Third Party Advisory
- https://github.com/ManageIQ/kubeclient/issues/555Issue Tracking, Patch, Third Party Advisory
- https://github.com/ManageIQ/kubeclient/issues/554Issue Tracking, Patch, Third Party Advisory
- https://github.com/ManageIQ/kubeclient/issues/555Issue Tracking, Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.