PT-2022-20897 · Kubernetes+1 · Kube-Apiserver+2

Nicolas Joly + 2 · Published 2022-09-16 · Updated 2023-12-21 · CVE-2022-3172

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions kube-apiserver (affected versions not specified)

Description A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

ALT-PU-2023-1520

ALT-PU-2023-1529

CVE-2022-3172

OESA-2022-1979

RHSA-2022:7398

RHSA-2023:1655

Affected Products

Alt Linux

Kubernetes

Kube-Apiserver

References · 18

• https://github.com/kubernetes/kubernetes/issues/112513 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9854.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-3172 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-1979 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3172 · Security Note
• https://linux.oracle.com/errata/ELSA-2022-9853.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3172 · Security Note
• https://linux.oracle.com/errata/ELSA-2022-9856.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-9855.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3172 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-3172 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3172 · Vendor Advisory
• https://twitter.com/CVEnew/status/1720511008387821868 · Twitter Post
• https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak · Note