GO-2023-2336 CVE-2023-42814 GHSA-9g37-h7p2-2c6r
Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyverno
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.67%
- Chance of exploitation in the next 30 days. Higher than 52.03% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
1.5.0-rc1.0.20230918070231-fec2992e3f9f- Upgrade github.com/kyverno/kyverno to this version or later
Description
Denial of service from malicious image manifest in kyverno in github.com/kyverno/kyverno
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/kyverno/kyverno | >= 1.5.0-rc1.0.20230601080528-80d139bb5d1d, < 1.5.0-rc1.0.20230918070231-fec2992e3f9f |
1.5.0-rc1.0.20230918070231-fec2992e3f9f |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/kyverno/kyverno Go → 1.5.0-rc1.0.20230918070231-fec2992e3f9f
- go
go get github.com/kyverno/kyverno@v1.5.0-rc1.0.20230918070231-fec2992e3f9f && go mod tidy
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Advisories
Fixes and patches
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-79gf-7frw-68m9 Kyverno's NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system | Critical | Also affects github.com/kyverno/kyverno |
| GHSA-fpjq-c37h-cqcv Kyverno Controller Denial of Service via forEach Mutation Panic | High | Also affects github.com/kyverno/kyverno |
| GHSA-8wfp-579w-6r25 Kyverno apiCall automatically forwards ServiceAccount token to external endpoints (credential leak) | High | Also affects github.com/kyverno/kyverno |
| GHSA-f9g8-6ppc-pqq4 Kyverno: ServiceAccount token leaked to external servers via apiCall service URL | Critical | Also affects github.com/kyverno/kyverno |
| GHSA-cvq5-hhx3-f99p Kyverno: Cross-Namespace Read Bypasses RBAC Isolation (CVE-2026-22039 Incomplete Fix) | High | Also affects github.com/kyverno/kyverno |
| GHSA-q93q-v844-jrqp kyverno apicall servicecall implicit bearer token injection leaks kyverno serviceaccount token | High | Also affects github.com/kyverno/kyverno |
| GHSA-fmqp-4wfc-w3v7 Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach | Medium | Also affects github.com/kyverno/kyverno |
| GHSA-qr4g-8hrp-c4rw Kyverno has unrestricted outbound requests in Kyverno apiCall enabling SSRF | High | Also affects github.com/kyverno/kyverno |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor