RubySecRUBY:KUBECLIENT-2022-0759Improper Certificate Validation in kubeclient
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
A flaw was found in all versions of kubeclient up to (but not including)
v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig
files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient
ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications
that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle
attacks (MITM).
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ruby | kubeclient | * | cpe:2.3:a:ruby:kubeclient:*:*:*:*:*:*:*:* |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H