Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1ocTRtLTQ5NDgtNjRjY84AAzol
Kyverno resource with a deletionTimestamp may allow policy circumvention
Impact
In versions of Kyverno prior to 1.10.0, resources which have the deletionTimestamp
field defined can bypass validate, generate, or mutate-existing policies, even in cases where the validationFailureAction
field is set to Enforce
.
This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted.
However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the deletionTimestamp
and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy.
Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies.
Patches
This is resolved in Kyverno 1.10.0.
Workarounds
There is no known workaround.
References
Are there any links users can visit to find out more?
Permalink: https://github.com/advisories/GHSA-hq4m-4948-64ccJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ocTRtLTQ5NDgtNjRjY84AAzol
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 11 months ago
Updated: 6 months ago
CVSS Score: 6.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Identifiers: GHSA-hq4m-4948-64cc, CVE-2023-34091
References:
- https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64cc
- https://nvd.nist.gov/vuln/detail/CVE-2023-34091
- https://github.com/kyverno/kyverno/releases/tag/v1.10.0
- https://github.com/advisories/GHSA-hq4m-4948-64cc
Blast Radius: 7.8
Affected Packages
go:github.com/kyverno/kyverno
Dependent packages: 21Dependent repositories: 16
Downloads:
Affected Version Ranges: < 1.10.0
Fixed in: 1.10.0
All affected versions: 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0, 0.6.0, 0.7.0, 0.7.1, 0.8.0, 0.9.0, 0.9.1, 0.10.0, 0.11.0, 1.0.0, 1.1.0, 1.1.1, 1.1.2, 1.1.3, 1.1.4, 1.1.5, 1.1.6, 1.1.7, 1.1.8, 1.1.9, 1.1.10, 1.1.11, 1.1.12, 1.2.0, 1.2.1, 1.3.0, 1.3.1, 1.3.2, 1.3.3, 1.3.4, 1.3.5, 1.3.6, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.5.0, 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 1.6.0, 1.6.1, 1.6.2, 1.6.3, 1.6.10, 1.7.0, 1.7.1, 1.7.2, 1.7.3, 1.7.4, 1.7.5, 1.8.0, 1.8.1, 1.8.2, 1.8.3, 1.8.4, 1.8.5, 1.9.0, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.9.5
All unaffected versions: 1.10.0, 1.10.1, 1.10.2, 1.10.3, 1.10.4, 1.10.5, 1.10.6, 1.10.7, 1.11.0, 1.11.1, 1.11.2, 1.11.3, 1.11.4, 1.12.0