Bug 1203510 (CVE-2022-3172) - VUL-0: CVE-2022-3172: kubernetes: kube-apiserver: Aggregated API server can cause clients to be redirected (SSRF)
Summary: VUL-0: CVE-2022-3172: kubernetes: kube-apiserver: Aggregated API server can c...
Status: RESOLVED FIXED
Alias: CVE-2022-3172
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Containers Team
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/342833/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2022-09-19 08:16 UTC by Thomas Leroy
Modified: 2024-07-23 07:11 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Leroy 2022-09-19 08:16:51 UTC 
rh#2127804

A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the
client performing unexpected actions as well as forwarding the client's API server credentials to third parties.

ref: https://github.com/kubernetes/kubernetes/issues/112513

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2127804
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3172
https://seclists.org/oss-sec/2022/q3/207
Comment 1 Thomas Leroy 2022-09-19 08:20:45 UTC 
Affected:
- SUSE:SLE-15-SP1:Update:Products:CASP40:Update
- openSUSE:Factory
Comment 2 Thomas Leroy 2022-09-19 09:38:54 UTC 
(In reply to Thomas Leroy from comment #1)
> Affected:
> - SUSE:SLE-15-SP1:Update:Products:CASP40:Update

CVSS < 8.0 sorry, so I guess wontfix for casp

> - openSUSE:Factory
Comment 4 Alexandre Vicenzi 2024-07-22 15:40:59 UTC 
This has been fixed in Factory a while ago but never mentioned in the changelog. Currently, we have Kubernetes 1.30 and this was fixed in 1.25.1.

We also provide older versions of Kubernetes. kubernetes1.24 is not affected since this was fixed in 1.24.5 and we have 1.24.17. kubernetes1.25 is not affected because we have 1.25.16.

Thomas, can you close this?
Comment 5 Thomas Leroy 2024-07-23 07:11:05 UTC 
(In reply to Alexandre Vicenzi from comment #4)
> This has been fixed in Factory a while ago but never mentioned in the
> changelog. Currently, we have Kubernetes 1.30 and this was fixed in 1.25.1.
> 
> We also provide older versions of Kubernetes. kubernetes1.24 is not affected
> since this was fixed in 1.24.5 and we have 1.24.17. kubernetes1.25 is not
> affected because we have 1.25.16.
> 
> Thomas, can you close this?

Moreover, we only support the client side of k8s. We can close this