CVE-2022-2385

aws-iam-authenticator (sigs.k8s.io/aws-iam-authenticator) contains CVE-2022-2385, where an allow-listed IAM identity may modify their username and escalate privileges. Technical details in connected docs indicate the issue relates to an AccessKeyID validation bypass in versions prior to v0.5.9. A...

PT-2022-16291

Name of the Vulnerable Software and Affected Versions aws-iam-authenticator versions prior to 0.5.9 Description A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges. Recommendations For versions...

Kubernetes: Bypass validation parts in AWS IAM Authenticator for Kubernetes

Multiple bypasses were discovered in AWS IAM Authenticator for Kubernetes. An attacker could craft a token without a signed cluster ID header and use it for replay attacks, manipulate the extracted AccessKeyID to gain higher permissions in the cluster, and send a request to other action values...