Em resumo
- CVE-2022-23652 é uma vulnerabilidade ALTO (CVSS 8.8) que afeta github.com/clastix/capsule-proxy, capsule-proxy (clastix).
- Chance de exploração nos próximos 30 dias (EPSS): 1.4%, maior que 72.4% das vulnerabilidades.
- Correção: atualize para 0.2.1 ou posterior.
Description
Impact
Using a malicious Connection header, an attacker with a proper authentication mechanism could start a privilege escalation towards the Kubernetes API Server, being able to exploit the cluster-admin Role bound to capsule-proxy.
Patches
Patch has been merged in the v0.2.1 release.
Workarounds
Upgrading is mandatory.
NVD description
capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious `Connection` header to start a privilege escalation attack towards the Kubernetes API Server. This vulnerability allows for an exploit of the `cluster-admin` Role bound to `capsule-proxy`. There are no known workarounds for this issue.
Mais vulnerabilidades de github.com/clastix/capsule-proxy
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free