SB2022111193 - Fedora 35 update for kubernetes

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022111193

SB2022111193 - Fedora 35 update for kubernetes

Published: November 11, 2022

Security Bulletin ID SB2022111193
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper access control (CVE-ID: CVE-2022-3162)

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different kind in the same API group they are not authorized to read.


2) Input validation error (CVE-ID: CVE-2022-3294)

The vulnerability allows a remote user to execute arbitrary cod on the system.

The vulnerability exists due to users may have access to secure endpoints in the control plane network. A remote user can trigger the vulnerability and allow authenticated requests destined for Nodes to the API server's private network.


Remediation

Install update from vendor's website.

References