GHSA-m3cq-xcx9-3gvm BIT-kyverno-2022-47633 CVE-2022-47633 GO-2022-1180
kyverno verifyImages rule bypass possible with malicious proxy/registry
- Severity
- 8.1 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 1.05%
- Chance of exploitation in the next 30 days. Higher than 64.21% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-287 Improper Authentication
- Fix
1.8.5- Upgrade github.com/kyverno/kyverno to this version or later
Description
Impact
Users of Kyverno on versions 1.8.3 or 1.8.4 who use verifyImages rules to verify container image signatures, and do not prevent use of unknown registries.
Patches
This issue has been fixed in version 1.8.5
Workarounds
Configure a Kyverno policy to restrict registries to a set of secure trusted image registries (sample).
References
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/kyverno/kyverno | >= 1.8.3, < 1.8.5 |
1.8.5 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/kyverno/kyverno Go → 1.8.5
- go
go get github.com/kyverno/kyverno@v1.8.5 && go mod tidy
Severity breakdown
CVSS 3.1 8.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
How to prevent it
- Architecture and Design: Use an authentication framework or library such as the OWASP ESAPI Authentication feature.
References
Advisories
Packages
Other links
- github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvm
- github.com/kyverno/kyverno/pull/5713
- github.com/kyverno/kyverno/compare/v1.8.4...v1.8.5
- github.com/kyverno/kyverno/releases/tag/v1.8.5
- kyverno.io/docs/writing-policies/verify-images
- kyverno.io/policies/best-practices/restrict_image_registries/restrict_image_reg…
- pkg.go.dev/vuln/GO-2022-1180
- web.archive.org/web/20230426095744/https://kyverno.io/policies/best-practices/restri…
- kyverno.io/docs/writing-policies/verify-images
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-79gf-7frw-68m9 Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system | Critical | Also affects github.com/kyverno/kyverno |
| GHSA-fpjq-c37h-cqcv Kyverno Controller Denial of Service via forEach Mutation Panic | High | Also affects github.com/kyverno/kyverno |
| GHSA-8wfp-579w-6r25 Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak) | High | Also affects github.com/kyverno/kyverno |
| GHSA-f9g8-6ppc-pqq4 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL | Critical | Also affects github.com/kyverno/kyverno |
| GHSA-cvq5-hhx3-f99p Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) | High | Also affects github.com/kyverno/kyverno |
| GHSA-q93q-v844-jrqp kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token | High | Also affects github.com/kyverno/kyverno |
| GHSA-fmqp-4wfc-w3v7 Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach | Medium | Also affects github.com/kyverno/kyverno |
| GHSA-qr4g-8hrp-c4rw Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF | High | Also affects github.com/kyverno/kyverno |
Credits: @slashben
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor