CVE-2022-0759: redhat kubeclient Improper Certificate Validation

Modified

AliasesUBUNTU-CVE-2022-0759DEBIAN-CVE-2022-0759GHSA-69p3-xp37-f692

Published 25-03-2022Last modified 02-08-2024

Vulnerability summary

CVE-2022-0759 is a high (CVSS 8.1) Improper Certificate Validation vulnerability in redhat kubeclient. EPSS estimates a 0.94% chance of exploitation in the next 30 days, higher than 61% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 8.1 (NVD); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

8.1/10

010

High · v3.1 (NVD)

EPSS score

0.94%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1

RHSA-2023:6818

Timeline

25-03-2022
PublishedVulnerability first disclosed.
02-08-2024
Last modifiedVulnerability information updated.

Description

A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).