PT-2023-28603 · Kyverno · Kyverno

Adamkorcz · Published 2023-11-13 · Updated 2024-08-21 · CVE-2023-42816

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Kyverno versions 1.11.0 and later, built from the main branch

Description A security issue was found in Kyverno, a policy engine for Kubernetes, where an attacker could cause a denial of service. The issue lies in Kyverno's Notary verifier. An attacker with control over the registry from which Kyverno fetches signatures could return a malicious response, causing a denial of service that blocks other users' admission requests. There are no known cases of this issue being exploited.

Recommendations For Kyverno versions 1.11.0 and later built from the main branch, consider avoiding the use of the Notary verifier until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2023-42816

GHSA-4MP4-46GQ-HV3R

GO-2023-2338

Affected Products

Kyverno

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42816.json · Exploit
• https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2 · Patch
• https://github.com/kyverno/kyverno/security/advisories/GHSA-4mp4-46gq-hv3r · Vendor Advisory
• https://github.com/kyverno/kyverno/pull/8428 · Patch
• https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b · Patch
• https://osv.dev/vulnerability/CVE-2023-42816 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42816 · Security Note
• https://osv.dev/vulnerability/GO-2023-2338 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1724215686174519351 · Twitter Post