LeaseTimeToLive API allows access to key names (not value) associated to a lease when Keys parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC).
Patches
< v3.4.26 and < v3.5.9 are affected.
Workarounds
No.
Reporter
Yoni Rozenshein
Severity
Low
CVE ID
CVE-2023-32082
Weaknesses
No CWEs
You can’t perform that action at this time.
You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.
Impact
LeaseTimeToLive API allows access to key names (not value) associated to a lease when
Keysparameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC).Patches
< v3.4.26 and < v3.5.9 are affected.
Workarounds
No.
Reporter
Yoni Rozenshein