k8s.io/kuberneteS-v1.15.9: 2 vulnerabilities (highest severity is: 6.6)

[dev-mend-for-github-com]

Vulnerable Library - k8s.io/kuberneteS-v1.15.9

Production-Grade Container Scheduling and Management

Library home page: https://proxy.golang.org/k8s.io/kubernetes/@v/v1.15.9.zip

Path to dependency file: /go_modules/spec/fixtures/projects/repo_not_found/go.mod

Path to vulnerable library: /go_modules/spec/fixtures/projects/repo_not_found/go.mod

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (k8s.io/kuberneteS-v1.15.9 version)	Remediation Possible**	Reachability
CVE-2022-3294	Medium	6.6	k8s.io/kuberneteS-v1.15.9	Direct	N/A	❌
CVE-2023-2727	Medium	6.5	k8s.io/kuberneteS-v1.15.9	Direct	N/A	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-3294

Vulnerable Library - k8s.io/kuberneteS-v1.15.9

Production-Grade Container Scheduling and Management

Library home page: https://proxy.golang.org/k8s.io/kubernetes/@v/v1.15.9.zip

Path to dependency file: /go_modules/spec/fixtures/projects/repo_not_found/go.mod

Path to vulnerable library: /go_modules/spec/fixtures/projects/repo_not_found/go.mod

Dependency Hierarchy:

• ❌ k8s.io/kuberneteS-v1.15.9 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network.

Publish Date: 2023-03-01

URL: CVE-2022-3294

CVSS 3 Score Details (6.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2023-2727

Vulnerable Library - k8s.io/kuberneteS-v1.15.9

Production-Grade Container Scheduling and Management

Library home page: https://proxy.golang.org/k8s.io/kubernetes/@v/v1.15.9.zip

Path to dependency file: /go_modules/spec/fixtures/projects/repo_not_found/go.mod

Path to vulnerable library: /go_modules/spec/fixtures/projects/repo_not_found/go.mod

Dependency Hierarchy:

• ❌ k8s.io/kuberneteS-v1.15.9 (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

Publish Date: 2023-07-03

URL: CVE-2023-2727

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.