Improper access control in apiserver - CVE-2022-3162

Vulnerability identifier: #VU71364

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-3162

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different kind in the same API group they are not authorized to read.

apiserver
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise Server 15 SP3 LTSS
Containers Module
openEuler
Fedora
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
Ansible Automation Platform
Red Hat Migration Toolkit for Applications
IBM Fusion HCI
kubernetes-help
kubernetes-kubeadm
kubernetes-node
kubernetes-kubelet
kubernetes-master
kubernetes
kubernetes-client
kubernetes1.23-client-debuginfo
kubernetes1.23-client-common
kubernetes1.23-client
microshift (Red Hat package)
OpenShift Service Mesh
IBM Netezza for Cloud Pak for Data
IBM InfoSphere Information Server

Install updates from vendor's website.

apiserver - addressed in versions 1.22.16, 1.23.14, 1.24.8, 1.25.4
Migration Toolkit for Containers - addressed in versions 1.7.7, 1.7.8
Red Hat OpenShift Container Platform - addressed in versions 4.12.0, 4.12.4
Red Hat Migration Toolkit for Applications - update to 6.1.0
kubernetes-help - update to 1.20.2-20
kubernetes-kubeadm - update to 1.20.2-20
kubernetes-node - update to 1.20.2-20
kubernetes-kubelet - update to 1.20.2-20
kubernetes-master - update to 1.20.2-20
kubernetes - update to 1.20.2-20
kubernetes-client - update to 1.20.2-20
kubernetes - addressed in versions 1.22.16-1.fc35, 1.22.17-1.fc35, 1.25.4-3.fc37
kubernetes1.23-client-debuginfo - update to 1.23.17-150300.7.6.1
kubernetes1.23-client-common - update to 1.23.17-150300.7.6.1
kubernetes1.23-client - update to 1.23.17-150300.7.6.1
OpenShift Service Mesh - update to 2.4.0
IBM Fusion HCI - update to 2.7.0
microshift (Red Hat package) - update to 4.12.4-202302151633.p0.gb9fe8ac.assembly.4.12.4.el8
IBM Netezza for Cloud Pak for Data - update to 11.2.3.3
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1

• https://access.redhat.com/errata/RHSA-2022:7399

• Improper access control in Kubernetes apiserver
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• OpenShift Container Platform 4.12 update for kubernetes
• Multiple vulnerabilities in Migration Toolkit for Containers (MTC)
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in OpenShift Container Platform 4.12
• Multiple vulnerabilities in IBM InfoSphere Information Server
• SUSE update for kubernetes1.23
• Multiple vulnerabiltiies in Red Hat OpenShift Service Mesh Containers 2.4
• Multiple vulnerabilities in IBM Storage Fusion
• openEuler 20.03 LTS SP3 update for kubernetes
• openEuler 22.03 LTS update for kubernetes
• openEuler 22.03 LTS SP1 update for kubernetes
• openEuler 22.03 LTS SP2 update for kubernetes
• Multiple vulnerabilities in Red Hat Ansible Automation Platform 2.4 for RHEL 9
• Fedora 35 update for kubernetes
• Fedora 37 update for kubernetes
• Fedora 35 update for kubernetes
• Multiple vulnerabilities in IBM Netezza for Cloud Pak for Data (on Cloud)