Lucene search

GoogleOSV:CVE-2022-47633

HistoryDec 23, 2022 - 11:15 p.m.

CVE-2022-47633

2022-12-2323:15:08

Google

osv.dev

kyverno

image validation

kubernetes

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.2%

JSON

An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This has been fixed in 1.8.5 and mitigations are available for impacted releases.

CPENameOperatorVersion
kyvernoeq1.1.6-rc3
kyvernoeq1.8.4-rc.1
kyvernoeqkyverno-policies-chart-2.6.0-rc1
kyvernoeq1.8-de
kyvernoeqkyverno-chart-2.6.3-rc.1
kyvernoeq1.3.0-rc6
kyvernoeq1.8.0-rc3
kyvernoeq1.3.6
kyvernoeq1.3.4-rc1
kyvernoeq0.11.0

Name	Operator	Version
kyverno	eq	1.1.6-rc3
kyverno	eq	1.8.4-rc.1
kyverno	eq	kyverno-policies-chart-2.6.0-rc1
kyverno	eq	1.8-de
kyverno	eq	kyverno-chart-2.6.3-rc.1
kyverno	eq	1.3.0-rc6
kyverno	eq	1.8.0-rc3
kyverno	eq	1.3.6
kyverno	eq	1.3.4-rc1
kyverno	eq	0.11.0

Rows per page:

1-10 of 1581

References

github.com/kyverno/kyverno/compare/v1.8.4...v1.8.5

github.com/kyverno/kyverno/pull/5713

github.com/kyverno/kyverno/releases/tag/v1.8.5

github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvm

kyverno.io/docs/writing-policies/verify-images/

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

54.2%

JSON

Related for OSV:CVE-2022-47633