CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
58.8%
IBM Cloud Kubernetes Service is affected by Kubernetes Ingress Controller security vulnerabilities where a user that can create or update Ingress objects can use the nginx.ingress.kubernetes.io/configuration-snippet
annotation (CVE-2023-5043) or the nginx.ingress.kubernetes.io/permanent-redirect
annotation (CVE-2023-5044) to inject arbitrary commands, or can use directives to bypass the sanitization of the spec.rules[].http.paths[].path field
(CVE-2022-4886) to obtain the credentials of the Kubernetes Ingress Controller (ALB). In the default configuration, that credential has access to all secrets in the cluster.
These vulnerabilities are relevant mainly in multi-tenant environments where non-admin users have permissions to create Ingress objects.
CVEID: CVE-2022-4886
Description: Ingress-nginx path
sanitization can be bypassed with log_format
directive.
CVSS Base Score: 8.8
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/269570> for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
CVEID: CVE-2023-5043
Description: Kubernetes ingress-nginx could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation by the
http://nginx.ingress.kubernetes.io/configuration-snippet|nginx.ingress.kubernetes.io/configuration-snippet annotation injection. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 7.6
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/269574> for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)
CVEID: CVE-2023-5044
Description: Kubernetes ingress-nginx could allow a remote authenticated attacker to execute arbitrary commands on the system, caused by improper input validation by the
http://nginx.ingress.kubernetes.io/permanent-redirect|nginx.ingress.kubernetes.io/permanent-redirect annotation. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system.
CVSS Base Score: 7.6
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/269578> for more information
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L)
IBM Cloud Kubernetes Service clusters with Kubernetes Ingress Controllers (ALBs - application load balancers) with versions below
<1.9.4_5698_iks
are impacted by CVE-2023-5043 and CVE-2023-5044<1.8.1_5317_iks
are additionally impacted by CVE-2022-4886New Kubernetes Ingress Controller (ALB) version 1.9.4_5698_iks
contains fixes for these vulnerabilities and is available immediately for early adopters. The fixed version will be automatically applied to all clusters once it has passed all GA validation and is marked as the default version for ALBs.
The new version provides annotation validation feature which allows clusters administrators to enforce restrictions on the contents of annotation fields for additional security. This feature will be enabled by default for Kubernetes Ingress Controller (ALB) versions 1.9.4_5698_iks
and later.
Action Required (before version 1.9.4_5698_iks
or later is marked as default)
To update your ALBs before the automatic update period for this version you will need to disable automatic updates and apply Kubernetes Ingress Controllers (ALBs) version 1.9.4_5698_iks
manually.
Review the annotations on your Ingress resources and make sure that the configuration values are valid.
To prevent the downgrading your ALBs to the current default version, use the following IBM Cloud CLI command to disable automatic updates:
ibmcloud ks ingress alb autoupdate disable
When automatic updates for the Ingress ALBs are disabled, you can force a one-time update of your ALBs with the following command:
ibmcloud ks ingress alb update --version 1.9.4_5698_iks
After you force a one-time update, automatic updates will need to remain disabled until version 1.9.4_5698_iks
or later is marked as the default version.
Action Required (after version 1.9.4_5698_iks
or later is marked as default)
Verify your IBM Cloud Kubernetes Service clusters with Kubernetes Ingress application load balancers (ALBs) are no longer exposed to these vulnerabilities, use the following IBM Cloud CLI command to list all Ingress ALB IDs in a cluster to confirm the version:
ibmcloud ks ingress alb ls
If the versions are at version 1.9.4_5698_iks
or later, they are no longer exposed.
2. Use the following IBM Cloud CLI command to confirm current the configuration of autoupdates:
ibmcloud ks ingress alb autoupdate get
If autoupdates are disabled, use the following IBM Cloud CLI command to re-enable the automatic updates by IBM when a new default image version is made available:
ibmcloud ks ingress alb autoupdate enable
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | ibm_cloud_kubernetes_service_and_red_hat_openshift_on_ibm_cloud | any | cpe:2.3:a:ibm:ibm_cloud_kubernetes_service_and_red_hat_openshift_on_ibm_cloud:any:*:*:*:*:*:*:* |
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
58.8%