GHSA-33hq-f2mf-jm3c
Suggest an improvement- Source
- https://github.com/advisories/GHSA-33hq-f2mf-jm3c
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-33hq-f2mf-jm3c/GHSA-33hq-f2mf-jm3c.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-33hq-f2mf-jm3c
- Aliases
- Published
- 2023-05-25T16:58:48Z
- Modified
- 2023-11-08T04:12:39.689725Z
- Severity
-
- 4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
- Summary
- kyverno seccomp control can be circumvented
- Details
-
Impact
Users of the podSecurity (
validate.podSecurity) subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using aversionvalue oflatest. There is no effect if a version number is referenced instead. See the documentation for information on this subrule type. Users of Kyverno v1.9.2 and v1.9.3 are affected.Patches
v1.9.4 v1.10.0
Workarounds
To work around this issue without upgrading to v1.9.4, temporarily install individual policies for the respective Seccomp checks in baseline here and restricted here.
References
- https://kyverno.io/docs/writing-policies/validate/#pod-security
- https://github.com/kyverno/kyverno/pull/7263
- References
Affected packages
Go / github.com/kyverno/kyverno
Package
- Name
- github.com/kyverno/kyverno
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/kyverno/kyverno