GHSA-33hq-f2mf-jm3c

Source

https://github.com/advisories/GHSA-33hq-f2mf-jm3c

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-33hq-f2mf-jm3c/GHSA-33hq-f2mf-jm3c.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-33hq-f2mf-jm3c

Aliases

Related

CVE-2023-33191

Published

2023-05-25T16:58:48Z

Modified

2024-08-20T20:59:06.412492Z

Severity

4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator

Summary

kyverno seccomp control can be circumvented

Details

Impact

Users of the podSecurity (validate.podSecurity) subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using a version value of latest. There is no effect if a version number is referenced instead. See the documentation for information on this subrule type. Users of Kyverno v1.9.2 and v1.9.3 are affected.

Patches

v1.9.4 v1.10.0

Workarounds

To work around this issue without upgrading to v1.9.4, temporarily install individual policies for the respective Seccomp checks in baseline here and restricted here.

References

https://kyverno.io/docs/writing-policies/validate/#pod-security
https://github.com/kyverno/kyverno/pull/7263

Database specific

{
    "nvd_published_at": "2023-05-30T07:15:09Z",
    "cwe_ids": [
        "CWE-284"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-05-25T16:58:48Z"
}

References

Affected packages

Go / github.com/kyverno/kyverno

Package

Name: github.com/kyverno/kyverno; View open source insights on deps.dev
Purl: pkg:golang/github.com/kyverno/kyverno

Affected ranges

Type: SEMVER
Events: Introduced

1.9.2

Fixed

1.9.4