Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS0zM2hxLWYybWYtam0zY84AAzeY
kyverno seccomp control can be circumvented
Impact
Users of the podSecurity (validate.podSecurity) subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using a version value of latest. There is no effect if a version number is referenced instead. See the documentation for information on this subrule type. Users of Kyverno v1.9.2 and v1.9.3 are affected.
Patches
v1.9.4
v1.10.0
Workarounds
To work around this issue without upgrading to v1.9.4, temporarily install individual policies for the respective Seccomp checks in baseline here and restricted here.
References
- https://kyverno.io/docs/writing-policies/validate/#pod-security
- https://github.com/kyverno/kyverno/pull/7263
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS0zM2hxLWYybWYtam0zY84AAzeY
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 11 months ago
Updated: 6 months ago
CVSS Score: 4.6
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Identifiers: GHSA-33hq-f2mf-jm3c, CVE-2023-33191
References:
- https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3c
- https://github.com/kyverno/kyverno/pull/7263
- https://github.com/kyverno/kyverno/releases/tag/v1.9.4
- https://nvd.nist.gov/vuln/detail/CVE-2023-33191
- https://github.com/advisories/GHSA-33hq-f2mf-jm3c
Blast Radius: 5.5
Affected Packages
go:github.com/kyverno/kyverno
Dependent packages: 21Dependent repositories: 16
Downloads:
Affected Version Ranges: >= 1.9.2, < 1.9.4
Fixed in: 1.9.4
All affected versions: 1.9.2, 1.9.3
All unaffected versions: 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0, 0.6.0, 0.7.0, 0.7.1, 0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.11.0, 1.0.0, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11, 1.1.12, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.10, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.9.0, 1.9.1, 1.9.4, 1.9.5, 1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.10.5, 1.10.6, 1.10.7, 1.11.0, 1.11.1, 1.11.2, 1.11.3, 1.11.4, 1.12.0