PT-2022-28078 · Kyverno · Kyverno

Slashben · Published 2022-12-21 · Updated 2025-09-12 · CVE-2022-47633

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.8.3 through 1.8.4

Description An image signature validation bypass issue allows a malicious image registry or a man-in-the-middle attacker to inject unsigned arbitrary container images into a protected Kubernetes cluster. This affects users of Kyverno who use verifyImages rules to verify container image signatures and do not prevent the use of unknown registries.

Recommendations For Kyverno versions 1.8.3 and 1.8.4, update to version 1.8.5 to resolve the issue. As a temporary workaround, consider configuring a Kyverno policy to restrict registries to a set of secure trusted image registries.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BIT-KYVERNO-2022-47633

CVE-2022-47633

GHSA-M3CQ-XCX9-3GVM

GO-2022-1180

Affected Products

Kyverno

References · 16

• https://github.com/kyverno/kyverno/compare/v1.8.4...v1.8.5 · Patch
• https://github.com/kyverno/kyverno/pull/5713 · Patch
• https://github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvm · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-47633 · Security Note
• https://osv.dev/vulnerability/BIT-kyverno-2022-47633 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m3cq-xcx9-3gvm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-47633 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-1180 · Vendor Advisory
• https://github.com/kyverno/kyverno · Note
• https://github.com/kyverno/kyverno/releases/tag/v1.8.5 · Note
• https://t.me/cibsecurity/55270 · Telegram Post
• https://kyverno.io/policies/best-practices/restrict_image_registries/restrict_image_registries · Note
• https://kyverno.io/docs/writing-policies/verify-images · Note
• https://web.archive.org/web/20230426095744/https://kyverno.io/policies/best-practices/restrict_image_registries/restrict_image_registries · Note
• https://t.me/cvenotify/40568 · Telegram Post