要点
- CVE-2022-23652 是影响 github.com/clastix/capsule-proxy, capsule-proxy (clastix) 的高危 (CVSS 8.8)漏洞。
- 未来 30 天内被利用的概率（EPSS）：1.4%，高于 72.4% 的漏洞。
- 修复：升级到 0.2.1 或更高版本。
Description
Impact
Using a malicious Connection header, an attacker with a proper authentication mechanism could start a privilege escalation towards the Kubernetes API Server, being able to exploit the cluster-admin Role bound to capsule-proxy.
Patches
Patch has been merged in the v0.2.1 release.
Workarounds
Upgrading is mandatory.
NVD description
capsule-proxy is a reverse proxy for Capsule Operator which provides multi-tenancy in Kubernetes. In versions prior to 0.2.1 an attacker with a proper authentication mechanism may use a malicious `Connection` header to start a privilege escalation attack towards the Kubernetes API Server. This vulnerability allows for an exploit of the `cluster-admin` Role bound to `capsule-proxy`. There are no known workarounds for this issue.
github.com/clastix/capsule-proxy 的其他漏洞
查看全部 →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free