Log in Start free

Vulnerability · Published Mar 25, 2022 · Assigned by redhat

CVE-2022-0759

High 8.1

In plain English

A high-severity improper certificate validation in kubeclient. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)8.1High
Exploit odds (30 days)0.9%top 38.8% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ruby-kubeclient4.9.3-1DEBIAN-CVE-2022-0759
Debian:13ruby-kubeclient4.9.3-1DEBIAN-CVE-2022-0759
Debian:14ruby-kubeclient4.9.3-1DEBIAN-CVE-2022-0759
RubyGemskubeclient4.9.3GHSA-69p3-xp37-f692
Ubuntu:22.04:LTSruby-kubeclientno fix listedUBUNTU-CVE-2022-0759
Ubuntu:24.04:LTSruby-kubeclientno fix listedUBUNTU-CVE-2022-0759
Ubuntu:25.10ruby-kubeclientno fix listedUBUNTU-CVE-2022-0759
Ubuntu:26.04:LTSruby-kubeclientno fix listedUBUNTU-CVE-2022-0759
Ubuntu:26.10ruby-kubeclientno fix listedUBUNTU-CVE-2022-0759

Affected products (as reported)

VendorProductVersions
n/a kubeclient 4.9.3

Weakness: CWE-295

References