CVE-2022-3294 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2022-3294 Interim 1 6 2023-06-12T23:32:48Z current 2023-03-02T00:33:36Z 2023-06-12T23:32:48Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2022-3294 Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-updates/2023-May/029534.html E-Mail link for SUSE-SU-2023:2292-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Server 15 SP4-TERADATA SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Module for Public Cloud 12 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP5 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP4 SUSE Linux Enterprise Module for Containers 15 SP4 openSUSE Tumbleweed kubernetes kubernetes-client kubernetes1.22-apiserver-1.22.17-1.1 kubernetes1.22-client-1.22.17-1.1 kubernetes1.22-client-common-1.22.17-1.1 kubernetes1.22-controller-manager-1.22.17-1.1 kubernetes1.22-kubeadm-1.22.17-1.1 kubernetes1.22-kubelet-1.22.17-1.1 kubernetes1.22-kubelet-common-1.22.17-1.1 kubernetes1.22-proxy-1.22.17-1.1 kubernetes1.22-scheduler-1.22.17-1.1 kubernetes1.23-apiserver-1.23.17-1.1 kubernetes1.23-client-1.23.17-1.1 kubernetes1.23-client-1.23.17-150300.7.6.1 kubernetes1.23-client-1.23.17-150500.1.3 kubernetes1.23-client-common-1.23.17-1.1 kubernetes1.23-client-common-1.23.17-150300.7.6.1 kubernetes1.23-client-common-1.23.17-150500.1.3 kubernetes1.23-controller-manager-1.23.17-1.1 kubernetes1.23-kubeadm-1.23.17-1.1 kubernetes1.23-kubelet-1.23.17-1.1 kubernetes1.23-kubelet-common-1.23.17-1.1 kubernetes1.23-proxy-1.23.17-1.1 kubernetes1.23-scheduler-1.23.17-1.1 kubernetes1.24-apiserver-1.24.11-1.1 kubernetes1.24-client-1.24.11-1.1 kubernetes1.24-client-1.24.13-150500.1.3 kubernetes1.24-client-common-1.24.11-1.1 kubernetes1.24-client-common-1.24.13-150500.1.3 kubernetes1.24-controller-manager-1.24.11-1.1 kubernetes1.24-kubeadm-1.24.11-1.1 kubernetes1.24-kubelet-1.24.11-1.1 kubernetes1.24-kubelet-common-1.24.11-1.1 kubernetes1.24-proxy-1.24.11-1.1 kubernetes1.24-scheduler-1.24.11-1.1 kubernetes1.25-apiserver-1.25.7-1.1 kubernetes1.25-client-1.25.7-1.1 kubernetes1.25-client-common-1.25.7-1.1 kubernetes1.25-controller-manager-1.25.7-1.1 kubernetes1.25-kubeadm-1.25.7-1.1 kubernetes1.25-kubelet-1.25.7-1.1 kubernetes1.25-kubelet-common-1.25.7-1.1 kubernetes1.25-proxy-1.25.7-1.1 kubernetes1.25-scheduler-1.25.7-1.1 kubernetes1.23-client-1.23.17-150300.7.6.1 as a component of SUSE Enterprise Storage 7.1 kubernetes1.23-client-common-1.23.17-150300.7.6.1 as a component of SUSE Enterprise Storage 7.1 kubernetes1.23-client-1.23.17-150300.7.6.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS kubernetes1.23-client-common-1.23.17-150300.7.6.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS kubernetes1.23-client-1.23.17-150300.7.6.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kubernetes1.23-client-common-1.23.17-150300.7.6.1 as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kubernetes1.23-client-1.23.17-150300.7.6.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP4 kubernetes1.23-client-common-1.23.17-150300.7.6.1 as a component of SUSE Linux Enterprise Module for Containers 15 SP4 kubernetes1.23-client-1.23.17-150500.1.3 as a component of SUSE Linux Enterprise Module for Containers 15 SP5 kubernetes1.23-client-common-1.23.17-150500.1.3 as a component of SUSE Linux Enterprise Module for Containers 15 SP5 kubernetes1.24-client-1.24.13-150500.1.3 as a component of SUSE Linux Enterprise Module for Containers 15 SP5 kubernetes1.24-client-common-1.24.13-150500.1.3 as a component of SUSE Linux Enterprise Module for Containers 15 SP5 kubernetes1.23-client-1.23.17-150300.7.6.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kubernetes1.23-client-common-1.23.17-150300.7.6.1 as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kubernetes1.23-client-1.23.17-150300.7.6.1 as a component of SUSE Linux Enterprise Server 15 SP4-TERADATA kubernetes1.23-client-common-1.23.17-150300.7.6.1 as a component of SUSE Linux Enterprise Server 15 SP4-TERADATA kubernetes1.23-client-1.23.17-150300.7.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 kubernetes1.23-client-common-1.23.17-150300.7.6.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 kubernetes1.22-apiserver-1.22.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.22-client-1.22.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.22-client-common-1.22.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.22-controller-manager-1.22.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.22-kubeadm-1.22.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.22-kubelet-1.22.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.22-kubelet-common-1.22.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.22-proxy-1.22.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.22-scheduler-1.22.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.23-apiserver-1.23.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.23-client-1.23.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.23-client-common-1.23.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.23-controller-manager-1.23.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.23-kubeadm-1.23.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.23-kubelet-1.23.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.23-kubelet-common-1.23.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.23-proxy-1.23.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.23-scheduler-1.23.17-1.1 as a component of openSUSE Tumbleweed kubernetes1.24-apiserver-1.24.11-1.1 as a component of openSUSE Tumbleweed kubernetes1.24-client-1.24.11-1.1 as a component of openSUSE Tumbleweed kubernetes1.24-client-common-1.24.11-1.1 as a component of openSUSE Tumbleweed kubernetes1.24-controller-manager-1.24.11-1.1 as a component of openSUSE Tumbleweed kubernetes1.24-kubeadm-1.24.11-1.1 as a component of openSUSE Tumbleweed kubernetes1.24-kubelet-1.24.11-1.1 as a component of openSUSE Tumbleweed kubernetes1.24-kubelet-common-1.24.11-1.1 as a component of openSUSE Tumbleweed kubernetes1.24-proxy-1.24.11-1.1 as a component of openSUSE Tumbleweed kubernetes1.24-scheduler-1.24.11-1.1 as a component of openSUSE Tumbleweed kubernetes1.25-apiserver-1.25.7-1.1 as a component of openSUSE Tumbleweed kubernetes1.25-client-1.25.7-1.1 as a component of openSUSE Tumbleweed kubernetes1.25-client-common-1.25.7-1.1 as a component of openSUSE Tumbleweed kubernetes1.25-controller-manager-1.25.7-1.1 as a component of openSUSE Tumbleweed kubernetes1.25-kubeadm-1.25.7-1.1 as a component of openSUSE Tumbleweed kubernetes1.25-kubelet-1.25.7-1.1 as a component of openSUSE Tumbleweed kubernetes1.25-kubelet-common-1.25.7-1.1 as a component of openSUSE Tumbleweed kubernetes1.25-proxy-1.25.7-1.1 as a component of openSUSE Tumbleweed kubernetes1.25-scheduler-1.25.7-1.1 as a component of openSUSE Tumbleweed kubernetes-client as a component of SUSE Linux Enterprise Module for Public Cloud 12 kubernetes as a component of SUSE Linux Enterprise Module for Public Cloud 12 Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network. CVE-2022-3294 SUSE Enterprise Storage 7.1:kubernetes1.23-client-1.23.17-150300.7.6.1 SUSE Enterprise Storage 7.1:kubernetes1.23-client-common-1.23.17-150300.7.6.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:kubernetes1.23-client-1.23.17-150300.7.6.1 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:kubernetes1.23-client-common-1.23.17-150300.7.6.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:kubernetes1.23-client-1.23.17-150300.7.6.1 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:kubernetes1.23-client-common-1.23.17-150300.7.6.1 SUSE Linux Enterprise Module for Containers 15 SP4:kubernetes1.23-client-1.23.17-150300.7.6.1 SUSE Linux Enterprise Module for Containers 15 SP4:kubernetes1.23-client-common-1.23.17-150300.7.6.1 SUSE Linux Enterprise Module for Containers 15 SP5:kubernetes1.23-client-1.23.17-150500.1.3 SUSE Linux Enterprise Module for Containers 15 SP5:kubernetes1.23-client-common-1.23.17-150500.1.3 SUSE Linux Enterprise Module for Containers 15 SP5:kubernetes1.24-client-1.24.13-150500.1.3 SUSE Linux Enterprise Module for Containers 15 SP5:kubernetes1.24-client-common-1.24.13-150500.1.3 SUSE Linux Enterprise Server 15 SP3-LTSS:kubernetes1.23-client-1.23.17-150300.7.6.1 SUSE Linux Enterprise Server 15 SP3-LTSS:kubernetes1.23-client-common-1.23.17-150300.7.6.1 SUSE Linux Enterprise Server 15 SP4-TERADATA:kubernetes1.23-client-1.23.17-150300.7.6.1 SUSE Linux Enterprise Server 15 SP4-TERADATA:kubernetes1.23-client-common-1.23.17-150300.7.6.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:kubernetes1.23-client-1.23.17-150300.7.6.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3:kubernetes1.23-client-common-1.23.17-150300.7.6.1 openSUSE Tumbleweed:kubernetes1.22-apiserver-1.22.17-1.1 openSUSE Tumbleweed:kubernetes1.22-client-1.22.17-1.1 openSUSE Tumbleweed:kubernetes1.22-client-common-1.22.17-1.1 openSUSE Tumbleweed:kubernetes1.22-controller-manager-1.22.17-1.1 openSUSE Tumbleweed:kubernetes1.22-kubeadm-1.22.17-1.1 openSUSE Tumbleweed:kubernetes1.22-kubelet-1.22.17-1.1 openSUSE Tumbleweed:kubernetes1.22-kubelet-common-1.22.17-1.1 openSUSE Tumbleweed:kubernetes1.22-proxy-1.22.17-1.1 openSUSE Tumbleweed:kubernetes1.22-scheduler-1.22.17-1.1 openSUSE Tumbleweed:kubernetes1.23-apiserver-1.23.17-1.1 openSUSE Tumbleweed:kubernetes1.23-client-1.23.17-1.1 openSUSE Tumbleweed:kubernetes1.23-client-common-1.23.17-1.1 openSUSE Tumbleweed:kubernetes1.23-controller-manager-1.23.17-1.1 openSUSE Tumbleweed:kubernetes1.23-kubeadm-1.23.17-1.1 openSUSE Tumbleweed:kubernetes1.23-kubelet-1.23.17-1.1 openSUSE Tumbleweed:kubernetes1.23-kubelet-common-1.23.17-1.1 openSUSE Tumbleweed:kubernetes1.23-proxy-1.23.17-1.1 openSUSE Tumbleweed:kubernetes1.23-scheduler-1.23.17-1.1 openSUSE Tumbleweed:kubernetes1.24-apiserver-1.24.11-1.1 openSUSE Tumbleweed:kubernetes1.24-client-1.24.11-1.1 openSUSE Tumbleweed:kubernetes1.24-client-common-1.24.11-1.1 openSUSE Tumbleweed:kubernetes1.24-controller-manager-1.24.11-1.1 openSUSE Tumbleweed:kubernetes1.24-kubeadm-1.24.11-1.1 openSUSE Tumbleweed:kubernetes1.24-kubelet-1.24.11-1.1 openSUSE Tumbleweed:kubernetes1.24-kubelet-common-1.24.11-1.1 openSUSE Tumbleweed:kubernetes1.24-proxy-1.24.11-1.1 openSUSE Tumbleweed:kubernetes1.24-scheduler-1.24.11-1.1 openSUSE Tumbleweed:kubernetes1.25-apiserver-1.25.7-1.1 openSUSE Tumbleweed:kubernetes1.25-client-1.25.7-1.1 openSUSE Tumbleweed:kubernetes1.25-client-common-1.25.7-1.1 openSUSE Tumbleweed:kubernetes1.25-controller-manager-1.25.7-1.1 openSUSE Tumbleweed:kubernetes1.25-kubeadm-1.25.7-1.1 openSUSE Tumbleweed:kubernetes1.25-kubelet-1.25.7-1.1 openSUSE Tumbleweed:kubernetes1.25-kubelet-common-1.25.7-1.1 openSUSE Tumbleweed:kubernetes1.25-proxy-1.25.7-1.1 openSUSE Tumbleweed:kubernetes1.25-scheduler-1.25.7-1.1 SUSE Linux Enterprise Module for Public Cloud 12:kubernetes SUSE Linux Enterprise Module for Public Cloud 12:kubernetes-client moderate 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H