CVE-2022-0759

Katalog CVE

CVSS 8.1 · High EPSS 0,94%

Kerentanan Improper Certificate Validation pada redhat kubeclient. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).

Rincian

Terbit di NVD

25 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,94% peluang dieksploitasi; lebih tinggi dari 59,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ManageIQ/kubeclient/issues/554 issue tracking · patch · advisory pihak ketiga
• https://github.com/ManageIQ/kubeclient/issues/555 issue tracking · patch · advisory pihak ketiga