Security Digest · Critical advisory (no CVE assigned)
GHSA-gg4x-fgg2-h9w9: Bypassing Kyverno Policies via Double Policy Exceptions
Summary If a cluster has a Kyverno policy in enforce mode and there are two exceptions, this allows the policy to be bypassed, even if the first exception is more restrictive than the second.
CVSS 9.0 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
govulncheck ./.... - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Go | github.com/kyverno/kyverno | >= 1.9.0, <= 1.12.7 | 1.13.0 |
Details
Summary If a cluster has a Kyverno policy in enforce mode and there are two exceptions, this allows the policy to be bypassed, even if the first exception is more restrictive than the second.
Details
The following policy was applied:
And two exceptions:
Trying to apply such a yaml will result in the expected ban:
However, if the load name is changed to satisfy the second exception, the restrictions can be bypassed:
It turns out that the second exception is higher in priority for Kyverno and allows for bypass of the restrictions.
Impact The security restrictions can be bypassed.
CVSS: 9.0 (v3.1) CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Sources and references
- GitHub Advisory GHSA-gg4x-fgg2-h9w9 github.com
- github.com github.com