CVE-2022-0759 json
Improper Certificate Validation in kubeclient
published 2022-03-25 4 y ago modified 2026-06-17 4 mo ago also GHSA-69p3-xp37-f692 , EUVD-2022-1339
- cvss
- 8.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 61%
- public exploits
- 0
- none known
Summary
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
Patch / fix
- rubygems kubeclient 4.9.3
- redhat kubeclient 4.9.3
- ruby-kubeclient Debian 14, Debian 13, Debian 12 4.9.3-1
debian advisories DEBIAN-CVE-2022-0759
- foreman satellite utils 6.14, satellite capsule 6.14, satellite 6.14 3.7.0.9-1.el8sat
- foreman-cli satellite utils 6.14, satellite 6.14 3.7.0.9-1.el8sat
- foreman-ec2 satellite 6.14 3.7.0.9-1.el8sat
- rubygem-git satellite 6.14 1.18.0-1.el8sat
- puppet-agent satellite capsule 6.14, satellite 6.14 7.26.0-3.el8sat
- puppetserver satellite capsule 6.14, satellite 6.14 7.11.0-1.el8sat
- rubygem-rack satellite capsule 6.14, satellite 6.14 2.2.7-1.el8sat
- foreman-ovirt satellite 6.14 3.7.0.9-1.el8sat
red hat advisories RHSA-2023:6818
- github.com/ManageIQ/kubeclient@109ea71 commit
- github.com/ManageIQ/kubeclient#556 pull request
- github.com/ManageIQ/kubeclient/issues/554 advisory
- github.com/ManageIQ/kubeclient/issues/555 advisory
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2022-0759 updated cvss 8.3
kubeclient: kubeconfig parsing error can lead to MITM attacks
-
Red Hat OpenShift Container Platform 3.11 rubygem-kubeclient Red Hat OpenShift GitOps openshift-gitops-1/argocd-rhel8affected: no fix planned “Will not fix”
-
Red Hat OpenShift Logging 5.2 openshift-logging/fluentd-rhel8 v1.7.4-176fixed: vendor fix RHSA-2022:2218
-
Red Hat OpenShift Logging 5.3 openshift-logging/fluentd-rhel8 v1.7.4-178fixed: vendor fix RHSA-2022:2217
-
Red Hat Satellite 6.14 for RHEL 8 rubygem-kubeclient 4.10.1-1.el8satfixed: vendor fix RHSA-2023:6818
-
Red Hat RHOL 5.4 for RHEL 8 openshift-logging/fluentd-rhel8 v1.14.5-3fixed: vendor fix RHSA-2022:1461
-
Red Hat RHOL 5.5 for RHEL 8 openshift-logging/fluentd-rhel8 v1.14.6-29fixed: vendor fix RHSA-2022:6051
-
Red Hat Logging Subsystem for Red Hat OpenShift rubygem-kubeclient Red Hat OpenShift Logging 5.2 openshift-logging/kibana6-rhel8 v6.8.1-188, openshift-logging/eventrouter-rhel8 v0.3.0-161, openshift-logging/elasticsearch6-rhel8 v6.8.1-157, openshift-logging/logging-curator5-rhel8 v5.8.1-124, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-168, openshift-logging/elasticsearch-rhel8-operator v5.2.10-5, +4 more Red Hat OpenShift Logging 5.3 openshift-logging/kibana6-rhel8 v6.8.1-190, openshift-logging/eventrouter-rhel8 v0.3.0-164, openshift-logging/elasticsearch6-rhel8 v6.8.1-159, openshift-logging/logging-curator5-rhel8 v5.8.1-126, openshift-logging/elasticsearch-proxy-rhel8 v1.0.0-171, openshift-logging/elasticsearch-rhel8-operator v5.3.7-5, +4 more Red Hat OpenShift Service Mesh 2.1 servicemesh, servicemesh-cni, servicemesh-pilot-agent, servicemesh-pilot-discovery Red Hat Satellite 6.14 for RHEL 8 cjson 1.7.14-5.el8sat, katello 4.9.0-1.el8sat, libsolv 0.7.22-4.el8pc, libcomps 0.1.18-4.el8pc, python-idna 3.3-2.el8pc, candlepin 4.3.1-1.el8sat, +668 more Red Hat RHOL 5.4 for RHEL 8 openshift-logging/vector-rhel8 v0.14-38, openshift-logging/kibana6-rhel8 v6.8.1-176, openshift-logging/logging-loki-rhel8 v2.5.0-1, openshift-logging/eventrouter-rhel8 v0.3.0-157, openshift-logging/opa-openshift-rhel8 v5.4.0-7, openshift-logging/logging-vector-rhel8 v0.14-38, +11 morenot affected: vulnerable code not present
+1 more productsfewer
Red Hat RHOL 5.5 for RHEL 8 openshift-logging/vector-rhel8 v0.21.0-8, openshift-logging/kibana6-rhel8 v6.8.1-262, openshift-logging/eventrouter-rhel8 v0.4.0-14, openshift-logging/logging-loki-rhel8 v2.6.1-9, openshift-logging/opa-openshift-rhel8 v0.1.0-7, openshift-logging/loki-rhel8-operator v5.5.0-33, +11 more
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
0.94% chance of exploitation in the next 30 days, higher than 61% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| rubygems | kubeclient | <4.9.3 |
4.9.3 |
Affected products
- n/a kubeclient
Classification
- Weakness
-
- CWE-295 Improper Certificate Validation
References
-
github.com
/ManageIQ/kubeclient/issues/554
web, issue-tracking, patch, third-party-advisory
-
github.com
/ManageIQ/kubeclient/issues/555
web, issue-tracking, patch, third-party-advisory
-
github.com
/ManageIQ/kubeclient/pull/556
web
-
github.com
/ManageIQ/kubeclient/commit/109ea71de5a8881748f03ebbe103b49f0f1c7887
web
-
nvd.nist.gov
/vuln/detail/CVE-2022-0759
advisory
-
github.com
/ManageIQ/kubeclient
package
-
github.com
/rubysec/ruby-advisory-db/blob/master/gems/kubeclient/CVE-2022-0759.yml
web
Sources
- CVE List CVE-2022-0759
- GitHub Advisory GHSA-69p3-xp37-f692
- NVD CVE-2022-0759
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.