요약
- CVE-2022-23652은(는) github.com/clastix/capsule-proxy, capsule-proxy (clastix)에 영향을 주는 높음 (CVSS 8.8) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 1.4%, 전체 취약점의 72.4%보다 높음.
- 조치: 0.2.1 이상으로 업데이트하세요.
Description
Impact
Using a malicious Connection header, an attacker with a proper authentication mechanism could start a privilege escalation towards the Kubernetes API Server, being able to exploit the cluster-admin Role bound to capsule-proxy.
Patches
Patch has been merged in the v0.2.1 release.
Workarounds
Upgrading is mandatory.
NVD description
capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious `Connection` header to start a privilege escalation attack towards the Kubernetes API Server. This vulnerability allows for an exploit of the `cluster-admin` Role bound to `capsule-proxy`. There are no known workarounds for this issue.
github.com/clastix/capsule-proxy의 다른 취약점
모두 보기 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free