PT-2023-28600 · Kyverno · Kyverno

Adamkorcz · Published 2023-11-13 · Updated 2024-08-21 · CVE-2023-42813

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.11.0 and later built from the main branch

Description A security issue was found in Kyverno, a policy engine for Kubernetes, where an attacker could cause denial of service. The vulnerable component is Kyverno's Notary verifier. An attacker would need control over the registry from which Kyverno fetches attestations to return a malicious response, causing denial of service and blocking other users' admission requests. There are no known cases of this issue being exploited in the wild.

Recommendations For Kyverno versions 1.11.0 and later built from the main branch, consider avoiding the use of the Notary verifier until a fix is available. Users consuming official Kyverno releases are not affected and do not need to take any action. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2023-42813

GHSA-WC3X-5RFV-HH5V

GO-2023-2335

Affected Products

Kyverno

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42813.json · Exploit
• https://github.com/kyverno/kyverno/security/advisories/GHSA-wc3x-5rfv-hh5v · Vendor Advisory
• https://github.com/kyverno/kyverno/pull/8428 · Patch
• https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b · Patch
• https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-42813 · Security Note
• https://osv.dev/vulnerability/GO-2023-2335 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42813 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1724215939263004828 · Twitter Post
• https://t.me/cvenotify/60919 · Telegram Post
• https://t.me/cvenotify/60916 · Telegram Post