CVE-2022-0759
Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 25 Mar 2022, 18:03
Last modified:02 Aug 2024, 23:40
Vulnerability Summary
Overall Risk (default)
medium
32/100 CVSS Score
8.1 HIGH
v3.1 (nvd)
EPSS Score
0.14% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
25 Mar 2022, 18:03
Published
Vulnerability first disclosed
02 Aug 2024, 23:40
Last Modified
Vulnerability information updated
Description
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
CVSS Metrics
- v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
EPSS Trends
Current EPSS score: 0.14%• Percentile: 33%
Techniques & Countermeasures
- CWE-295•Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
Affected Systems
- redhat•kubeclient
< 4.9.3