Risk | Medium |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2022-0759 |
CWE-ID | CWE-295 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
kubeclient Web applications / Other software |
Vendor | ManageIQ |
Security Bulletin
This security bulletin contains one medium risk vulnerability.
EUVDB-ID: #VU62574
Risk: Medium
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-0759
CWE-ID:
CWE-295 - Improper Certificate Validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to the way kubeclient parses kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs,
kubeclient ends up accepting any certificate (it wrongly returns
VERIFY_NONE). A remote attacker can perform MitM attack.
Install updates from vendor's website.
Vulnerable software versionskubeclient: 0.0.5 - 4.9.2
External linkshttp://github.com/ManageIQ/kubeclient/issues/554
http://github.com/ManageIQ/kubeclient/issues/555
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.