GitHub Advisoryadvisory · Go

GHSA-33hq-f2mf-jm3c kyverno seccomp control can be circumvented

MEDIUM Published 2023-05-25 Modified 2023-06-01 Official page ↗
Aliases
CVE-2023-33191
Ecosystem
Go
Packages
github.com/kyverno/kyverno
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Weaknesses
CWE-284
Reviewed
2023-05-25

Affected packages

• Go github.com/kyverno/kyverno: >= 1.9.2, < 1.9.4 → fixed in 1.9.4

Description

Impact Users of the podSecurity (`validate.podSecurity`) subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using a `version` value of `latest`. There is no effect if a version number is referenced instead. See the documentation for information on this subrule type. Users of Kyverno v1.9.2 and v1.9.3 are affected. Patches v1.9.4 v1.10.0 Workarounds To work around this issue without upgrading to v1.9.4, temporarily install individual policies for the respective Seccomp checks in baseline here and restricted here. References • https://kyverno.io/docs/writing-policies/validate/#pod-security • https://github.com/kyverno/kyverno/pull/7263

Related

Alias · CVE (1)

  • CVE-2023-33191 Kyverno is a policy engine designed for Kubernetes. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References