PT-2022-16291 · Amazon+1 · Aws-Iam-Authenticator+1

Gafnit Amiga · Published 2022-07-12 · Updated 2024-08-21 · CVE-2022-2385

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions aws-iam-authenticator versions prior to 0.5.9

Description A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.

Recommendations For versions prior to 0.5.9, update to version 0.5.9 or later to resolve the issue. As a temporary workaround, consider restricting access to allow-listed IAM identities to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2022-2385

GHSA-PP3F-98QG-5G75

GO-2022-0547

OPENSUSE-SU-2022_2583-1

SUSE-SU-2022:2583-1

SUSE-SU-2022_2583-1

Affected Products

Suse

Aws-Iam-Authenticator

References · 18

• https://osv.dev/vulnerability/SUSE-SU-2022:2583-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2385 · Security Note
• https://osv.dev/vulnerability/CVE-2022-2385 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pp3f-98qg-5g75 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0547 · Vendor Advisory
• https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/472 · Note
• https://github.com/kubernetes-sigs/aws-iam-authenticator · Note
• https://github.com/kubernetes-sigs/aws-iam-authenticator/commit/029d1dcf2ec8d662d9b1c21260bb197404bc8218 · Note
• https://github.com/kubernetes-sigs/aws-iam-authenticator/pull/469 · Note
• https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/tag/v0.5.9 · Note
• https://t.me/cvenotify/32961 · Telegram Post
• https://github.com/advisories/GHSA-pp3f-98qg-5g75 · Note
• https://suse.com/support/update/announcement/2022/suse-su-20222583-1 · Note
• https://bugzilla.suse.com/1201395 · Note
• https://t.me/cibsecurity/46080 · Telegram Post