CVE-2023-33191 kyverno seccomp control can be circumvented
Attackers can bypass Kyverno seccomp controls in Kubernetes, undermining security policies for users with specific pod security validation enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-33191?
CVE-2023-33191 is a medium-severity vulnerability in kyverno, published on 30 May 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4.
Weakness: CWE-284
Which versions are affected by CVE-2023-33191?
3 open source packages ship an affected version, including github.com/kyverno/kyverno. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kyverno/kyverno Go | From 1.9.2 | 1.9.4 |
github.com/kyverno/kyverno Go | From 1.9.2 | 1.9.4 |
github.com/kyverno/kyverno Go | From 1.9.2 | 1.9.4 |
Products include Nirmata Kyverno.
How do I fix CVE-2023-33191?
Upgrade github.com/kyverno/kyverno to 1.9.4 or later.
Is CVE-2023-33191 being exploited?
There is no known exploitation of CVE-2023-33191 in the wild and no public exploit code.
Other vulnerabilities in kyverno
- CVE-2024-48921 Kyverno's PolicyException objects can be created in any namespace by default
- CVE-2023-34091 Kyverno resource with a deletionTimestamp may allow policy circumvention
- CVE-2023-42813 Denial of service from malicious manifest in kyverno
- CVE-2023-42816 Denial of service from malicious signature in kyverno
- CVE-2023-42814 Denial of service from malicious image manifest in kyverno
Sources
Also known as GHSA-33hq-f2mf-jm3c, GO-2023-1801.