Database/Container, Kubernetes & orchestration

Kubernetes (kube-apiserver): Node address not verified when proxying

CVSS 6.6CVE-2022-3294Container, Kubernetes & orchestrationcurated

Impact

Node address not verified when proxying; a user who can modify Node objects reaches control-plane-only endpoints

Who can reach it

Cluster user able to patch Node objects

What to do

Rolling control-plane upgrade; restrict Node patch RBAC

References

https://nvd.nist.gov/vuln/detail/CVE-2022-3294

Related entries

Kubernetes (kube-apiserver): YAML parsing CPU exhaustion in the apiserverCVE-2019-11254 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Node updates bypass a validating admission webhook, defeating node-level policyCVE-2021-25735 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Users authorized to list/watch one namespaced CR type can read other CR types in the sameCVE-2022-3162 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Ephemeral containers bypass the ImagePolicyWebhook, so unapproved images runCVE-2023-2727 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Ephemeral containers bypass the ServiceAccount mountable-secrets policyCVE-2023-2728 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Unvalidated redirect on proxied upgrade requests lets a compromised node escalate to otherCVE-2020-8559 · Kubernetes (kube-apiserver)Medium

All Container, Kubernetes & orchestration entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.