Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CVE-2022-3172][Kubernetes upstream] Aggregated API server can cause clients to be redirected (SSRF) #38994

Closed
macedogm opened this issue Sep 19, 2022 · 1 comment
Closed

[CVE-2022-3172][Kubernetes upstream] Aggregated API server can cause clients to be redirected (SSRF) #38994

macedogm opened this issue Sep 19, 2022 · 1 comment
Assignees
@cwayne18 @snasovich @Sahota1225
Labels
area/k3s area/kubernetes area/rke2 RKE2-related Issues area/security team/hostbusters The team that is responsible for provisioning/managing downstream clusters + K8s version support team/rke2

Comments

@macedogm
Copy link
Member

macedogm commented Sep 19, 2022 •
edited

This issue is to track upstream CVE-2022-3172 in Kubernetes affecting the API server

Original upstream issue kubernetes/kubernetes#112513.

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.

This issue has been rated medium and assigned CVE-2022-3172.

CVSS Rating: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L (5.1, medium)

Am I vulnerable?

All Kubernetes clusters with the following versions that are running aggregated API servers are impacted. To identify if you have aggregated API servers configured, run the following command:

kubectl get apiservices.apiregistration.k8s.io -o=jsonpath='{range .items[?(@.spec.service)]}{.metadata.name}{"\n"}{end}'

Affected Versions

Upstream Kubernetes RKE RKE2 K3s
kube-apiserver v1.21 <= v1.21.14-rancher1-1 <= v1.21.14+rke2r1 <= v1.21.14+k3s1
kube-apiserver v1.22.0 - v1.22.13 <= v1.22.13-rancher1-1 <= v1.22.13+rke2r1 <= v1.22.13+k3s1
kube-apiserver v1.23.0 - v1.23.10 <= v1.23.10-rancher1-1 <= v1.23.10+rke2r1 <= v1.23.10+k3s1
kube-apiserver v1.24.0 - v1.24.4 <= v1.24.4-rancher1-1 <= v1.24.4+rke2r1 <= v1.24.4+k3s1
kube-apiserver v1.25.0 Not available v1.25.0+rke2r12 v1.25.0+k3s12

There are no known mitigations to this vulnerability.

Fixed Versions

Upstream Kubernetes RKE RKE2 K3s
kubelet v1.22.14 >= v1.22.15-rancher1-1 >= v1.22.15+rke2r2 >= v1.22.15+k3s1
kubelet v1.23.11 >= v1.23.12-rancher1-1 >= v1.23.13+rke2r1 >= v1.23.13+k3s1
kubelet v1.24.5 >= v1.24.6-rancher1-1 >= v1.24.7+rke2r1 >= v1.24.7+k3s1
kubelet v1.25.0 Not available v1.25.0+rke2r12 >= v1.25.0+k3s12

Toggle commit message |

1 Not available in Rancher >= v2.6.9 and >= v2.7.0 yet.
2 Not supported in Rancher.
@macedogm macedogm added area/kubernetes area/security area/k3s area/rke2 RKE2-related Issues team/hostbusters The team that is responsible for provisioning/managing downstream clusters + K8s version support team/rke2 labels Sep 19, 2022
@bk201 bk201 mentioned this issue Sep 20, 2022
Closed
@macedogm macedogm mentioned this issue Sep 22, 2022
Closed
@macedogm
Copy link
Member Author

macedogm commented Nov 21, 2022 •
edited

Closing this issue, as the fixed versions of RKE, RKE2 and K3s are already available in Rancher >= v2.6.9 and >= v2.7.0.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@cwayne18 cwayne18

@snasovich snasovich

@Sahota1225 Sahota1225

Labels
area/k3s area/kubernetes area/rke2 RKE2-related Issues area/security team/hostbusters The team that is responsible for provisioning/managing downstream clusters + K8s version support team/rke2
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@cwayne18 @macedogm @snasovich @Sahota1225