PT-2023-24208 · Kyverno · Kyverno

Chipzoller · Published 2023-05-25 · Updated 2024-08-20 · CVE-2023-33191

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.9.2 through 1.9.3

Description Kyverno is a policy engine designed for Kubernetes. The issue concerns the Kyverno seccomp control, which can be circumvented. Users of the podSecurity validate.podSecurity subrule are affected. The problem arises when using a version value of latest, but there is no effect if a version number is referenced instead.

Recommendations For Kyverno versions 1.9.2 and 1.9.3, upgrade to version 1.9.4 to resolve the issue. As a temporary workaround for versions 1.9.2 and 1.9.3, consider installing individual policies for the respective Seccomp checks in baseline and restricted modes.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2023-33191

GHSA-33HQ-F2MF-JM3C

GO-2023-1801

Affected Products

Kyverno

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33191.json · Exploit
• https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33191 · Security Note
• https://osv.dev/vulnerability/GO-2023-1801 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-33hq-f2mf-jm3c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33191 · Vendor Advisory
• https://github.com/kyverno/kyverno · Note
• https://github.com/kyverno/kyverno/releases/tag/v1.9.4 · Note
• https://github.com/kyverno/kyverno/pull/7263 · Note
• https://t.me/cvenotify/51352 · Telegram Post
• https://t.me/cvenotify/51771 · Telegram Post