UBUNTU-CVE-2022-0759
Advisory lineage Upstream: 1 Downstream: 0
Upstream
Published: 25 Mar 2022, 19:15
Last modified:20 May 2026, 16:07
Vulnerability Summary
Overall Risk (default)
medium
32/100 CVSS Score
8.1 HIGH
3.1 (osv_ubuntu)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
25 Mar 2022, 19:15
Published
Vulnerability first disclosed
20 May 2026, 16:07
Last Modified
Vulnerability information updated
Description
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
CVSS Metrics
- v3.1•HIGH•Score: 8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Systems
- ubuntu•ruby-kubeclient
all | all | all | all | all | all