Vulnerability · Published May 30, 2023 · Assigned by GitHub_M
CVE-2023-33191kyverno seccomp control can be circumvented
Medium 4.6
In plain English
A medium-severity improper access control in kyverno from kyverno. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.6Medium
Exploit odds (30 days)0.5%top 58.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/kyverno/kyverno | 1.9.4 | GHSA-33hq-f2mf-jm3c |
| Go | github.com/kyverno/kyverno | 1.9.4 | GO-2023-1801 |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
References
- https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3c x_refsource_CONFIRM
- https://github.com/kyverno/kyverno/pull/7263 x_refsource_MISC
- https://github.com/kyverno/kyverno/releases/tag/v1.9.4 x_refsource_MISC