Bug 2058404 (CVE-2022-0759)
| Summary: | CVE-2022-0759 kubeclient: kubeconfig parsing error can lead to MITM attacks | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Mauro Matteo Cascella <mcascell> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | bbuckingham, bcourt, bmontgom, btotty, cben, ehelms, eparis, ewolinet, jburrell, jcantril, jokerman, jsherril, jwendell, lzap, mhulan, mmccune, myarboro, nmoumoul, nstielau, orabin, ovanders, pcreech, periklis, rcernich, rchan, security-response-team, shsaxena, sponnaga, vinair, vkumar, ytale |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | kubeclient 4.9.3 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in kubeclient, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-04-21 01:31:12 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2058656, 2067289 | ||
| Bug Blocks: | 2058533 | ||
|
Description
Mauro Matteo Cascella
2022-02-24 20:11:52 UTC
Upstream patches. issues: https://github.com/ManageIQ/kubeclient/issues/554 + https://github.com/ManageIQ/kubeclient/issues/555 PRs: https://github.com/ManageIQ/kubeclient/pull/556 + https://github.com/ManageIQ/kubeclient/pull/557 Red Hat Satellite ships affected RubyGem Kubeclient, however, the product is not vulnerable, since it does not parse KubeClient through the affected "Kubeclient::Config" code. Therefore, we are reducing product impact to low. This issue has been addressed in the following products: RHOL-5.4-RHEL-8 Via RHSA-2022:1461 https://access.redhat.com/errata/RHSA-2022:1461 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-0759 This issue has been addressed in the following products: OpenShift Logging 5.2 Via RHSA-2022:2218 https://access.redhat.com/errata/RHSA-2022:2218 This issue has been addressed in the following products: OpenShift Logging 5.3 Via RHSA-2022:2217 https://access.redhat.com/errata/RHSA-2022:2217 This issue has been addressed in the following products: RHOL-5.5-RHEL-8 Via RHSA-2022:6051 https://access.redhat.com/errata/RHSA-2022:6051 This issue has been addressed in the following products: Red Hat Satellite 6.14 for RHEL 8 Via RHSA-2023:6818 https://access.redhat.com/errata/RHSA-2023:6818 |