Bug 2107036 (CVE-2022-2385) - CVE-2022-2385 aws-iam-authenticator: AccessKeyID validation bypass
Summary: CVE-2022-2385 aws-iam-authenticator: AccessKeyID validation bypass
Keywords:
Status: NEW
Alias: CVE-2022-2385
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2107517 2107518 2107519
Blocks: 2107038
TreeView+ depends on / blocked
 
Reported: 2022-07-14 07:52 UTC by TEJ RATHI
Modified: 2023-07-07 08:29 UTC (History)
8 users (show)

Fixed In Version: aws-iam-authenticator 0.5.9
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in aws-iam-authenticator. This issue occurs when an allow-listed IAM identity may be able to modify their username and escalate privileges.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description TEJ RATHI 2022-07-14 07:52:33 UTC 
A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.

https://groups.google.com/a/kubernetes.io/g/dev/c/EMxHpU-1ZYs
https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/472
Comment 1 Avinash Hanwate 2022-07-15 10:54:05 UTC 
Created golang-sigs-k8s-aws-iam-authenticator tracking bugs for this issue:

Affects: fedora-all [bug 2107519]
Note You need to log in before you can comment on or make changes to this bug.