GHSA-hq4m-4948-64cc

Source

https://github.com/advisories/GHSA-hq4m-4948-64cc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/06/GHSA-hq4m-4948-64cc/GHSA-hq4m-4948-64cc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hq4m-4948-64cc

Aliases

Related

Published

2023-06-05T17:10:13Z

Modified

2024-08-20T20:58:31.604028Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Kyverno resource with a deletionTimestamp may allow policy circumvention

Details

Impact

In versions of Kyverno prior to 1.10.0, resources which have the deletionTimestamp field defined can bypass validate, generate, or mutate-existing policies, even in cases where the validationFailureAction field is set to Enforce.

This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted.

However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the deletionTimestamp and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy.

Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies.

Patches

This is resolved in Kyverno 1.10.0.

Workarounds

There is no known workaround.

References

Are there any links users can visit to find out more?

Database specific

{
    "nvd_published_at": "2023-06-01T17:15:10Z",
    "cwe_ids": [
        "CWE-285"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-06-05T17:10:13Z"
}

References

Affected packages

Go / github.com/kyverno/kyverno

Package

Name: github.com/kyverno/kyverno; View open source insights on deps.dev
Purl: pkg:golang/github.com/kyverno/kyverno

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.10.0