CVE-2023-42813: Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno…

PriorityP424medium5.3CVSS 3.1

AVNACHPRNUIRSUCNINAH

ITW

Exploited in the wild

EPSS

0.66%

46.8th percentile

Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerable component in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch attestations. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
github.com	kyverno_kyverno	>= 1.5.0-rc1.0.20230601080528-80d139bb5d1d < 1.5.0-rc1.0.20230918070231-fec2992e3f9f	1.5.0-rc1.0.20230918070231-fec2992e3f9f
kyverno	kyverno	—	—
nirmata	kyverno	—	—

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.