Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-3162 EUVD-2023-0823GHSA-2394-5535-8j88GO-2023-1628

Unauthorized read of Custom Resources

Published Mar 1, 2023 · Updated Mar 7, 2025 · Assigned by kubernetes

Vendor: Kubernetes Product: Kubernetes Package: cert-manager Package: github.com/kubernetes/kubernetes Package: k8s.io/kubernetes Package: keda Package: kube-vip-cloud-provider Package: kubernetes Package: kubernetes Package: prometheus-adapter Package: rook Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Go

Description

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.

Affected products

VendorProductAffectedFixed
Kubernetes Kubernetes unspecified – ≤ v1.25.3, unspecified – ≤ v1.24.7, unspecified – ≤ v1.23.13, unspecified – ≤ v1.22.15 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 kubernetes 1.20.5+really1.20.2-1 —
Debian 13 kubernetes 1.20.5+really1.20.2-1 —
Debian 12 kubernetes 1.20.5+really1.20.2-1 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Openshift Ironic 4 crudini 0.9.3-4.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 future 0.18.2-9.el9.1 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-ironic +4 1:21.0.1-0.20221114235951.fe64d5e.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-ironic-inspector +3 11.0.1-0.20221205155952.cd22607.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-ironic-python-agent 9.0.1-0.20220818145522.ad1eb41.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 openstack-macros 2020.1.2-1.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 pyOpenSSL +1 20.0.1-2.el9.1 RHSA-2022:7398
Red Hat Openshift Ironic 4 pyflakes 2.2.0-3.el9.1 RHSA-2022:7398
Red Hat Openshift Ironic 4 pysnmp 4.4.12-6.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-SecretStorage 2.3.1-9.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-alembic 1.6.0-1.el9 RHSA-2022:7398
Red Hat Openshift Ironic 4 python-amqp +1 5.0.6-1.el9 RHSA-2022:7398
Red Hat OpenShift 4 NetworkManager +14 1:1.36.0-8.el8_6 RHSA-2022:7398
Red Hat OpenShift 4 afterburn +1 5.3.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 afterburn-dracut 5.3.0-1.rhaos4.12.el9 RHSA-2022:7398
Red Hat OpenShift 4 ansible-runner +1 1.4.6-2.el8ar RHSA-2022:7398
Red Hat OpenShift 4 ansible-runner-http 1.0.0-2.el8ar RHSA-2022:7398
Red Hat OpenShift 4 atomic-openshift-service-idler 4.12.0-202210141624.p0.ga0f9090.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 bootupd +1 0.2.5-3.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 buildah +1 1:1.23.4-2.el8 RHSA-2022:7398
Red Hat OpenShift 4 butane +1 0.16.0-2.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 conmon 2:2.1.2-2.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 conmon-rs 0.4.0-2.rhaos4.12.git.el8 RHSA-2022:7398
Red Hat OpenShift 4 console-login-helper-messages +2 0.20.4-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 container-selinux 2:2.188.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 containernetworking-plugins 1.0.1-5.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 containers-common 2:1-27.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 coreos-installer +1 0.16.1-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 coreos-installer-dracut 0.16.1-1.rhaos4.12.el9 RHSA-2022:7398
Red Hat OpenShift 4 cri-o 1.25.1-5.rhaos4.12.git6005903.el8 RHSA-2022:7398
Red Hat OpenShift 4 cri-tools 1.25.0-2.el8 RHSA-2022:7398
Red Hat OpenShift 4 crit +4 3.15-4.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 crudini 0.9-11.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 crun 1.4.2-1.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 fuse-overlayfs 1.9-1.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 grpc +4 1.18.0-4.el8ost RHSA-2022:7398
Red Hat OpenShift 4 haproxy +1 2.2.24-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 ignition +1 2.14.0-5.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 kata-containers 2.5.2-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 kernel-rt +15 4.18.0-372.40.1.rt7.197.el8_6 RHSA-2022:7398
Red Hat OpenShift 4 libslirp +1 4.4.0-2.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 microshift +3 4.12.4-202302151633.p0.gb9fe8ac.assembly.4.12.4.el8 RHSA-2023:0772
Red Hat OpenShift 4 nmstate +4 1.3.3-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift +1 4.12.0-202301042257.p0.g77bec7a.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift-ansible +1 4.12.0-202211071957.p0.g3a9d20e.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift-clients +1 4.12.0-202301042257.p0.g854f807.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 openshift-kuryr +4 4.12.0-202210261235.p0.g92b9be2.assembly.stream.el8 RHSA-2022:7398
Red Hat OpenShift 4 openvswitch2.17 +5 2.17.0-62.el8fdp RHSA-2022:7398
Red Hat OpenShift 4 ostree +3 2022.2-5.el8 RHSA-2022:7398
Red Hat OpenShift 4 ovn22.06 +3 22.06.0-27.el8fdp RHSA-2022:7398
Red Hat OpenShift 4 ovn22.09 +3 22.09.0-25.el8fdp RHSA-2022:7398
Red Hat OpenShift 4 podman +5 2:4.2.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 podman-gvproxy 3:4.2.0-4.rhaos4.12.el9 RHSA-2022:7398
Red Hat OpenShift 4 pycdlib-tools +2 1.11.0-3.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-alembic +1 1.4.2-5.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-amqp +2 2.5.2-7.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-cmd2 +1 1.4.0-1.1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-construct +1 2.10.56-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-dogpile-cache +1 1.1.2-1.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-eventlet +1 0.30.2-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-flask +2 1:1.1.1-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-funcsigs +2 1.0.2-8.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-gunicorn +1 19.9.0-10.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-ifaddr +1 0.1.6-5.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-importlib-metadata +1 1.7.0-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-iso8601 +1 0.1.12-8.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-jsonschema +1 3.2.0-5.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-kombu +1 1:4.6.6-7.el8ost.1 RHSA-2022:7398
Red Hat OpenShift 4 python-kubernetes +2 25.3.0-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-lockfile +1 1:0.11.0-8.el8ar RHSA-2022:7398
Red Hat OpenShift 4 python-msgpack +1 0.6.2-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-config +1 2:8.7.1-0.20211012155707.1a7bd66.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-context +2 3.3.1-0.20211012152439.641a1e0.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-db +3 9.1.0-0.20211020204148.be2cc6a.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-i18n +2 5.1.0-0.20211012165753.b031d17.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-log +3 4.6.0-0.20211012154701.41c8807.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-messaging +2 12.9.1-0.20211020204149.f9de265.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-metrics +2 0.3.0-0.20211020174122.43eee50.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-policy +3 3.8.2-0.20211012161944.c7fd9f4.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-oslo-serialization +2 4.2.0-0.20211012151454.2b94a4f.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-packaging +2 20.4-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-paste +1 3.2.4-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-paste-deploy +1 2.0.1-4.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pexpect +1 4.6-2.el8ar RHSA-2022:7398
Red Hat OpenShift 4 python-pint +1 0.10.1-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyghmi +1 1.5.14-2.1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyperclip +2 1.6.4-6.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyroute2 +1 0.5.13-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-pyrsistent +1 0.16.0-3.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-requests-unixsocket +1 0.1.5-5.el8ar RHSA-2022:7398
Red Hat OpenShift 4 python-rsa +1 4.7-1.el8 RHSA-2022:7398
Red Hat OpenShift 4 python-tenacity +1 6.2.0-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-wcwidth +1 0.1.7-14.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-werkzeug +1 1.0.1-3.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-zeroconf +1 0.24.4-1.el8ost RHSA-2022:7398
Red Hat OpenShift 4 python-zipp +1 0.5.1-2.el8ost RHSA-2022:7398
Red Hat OpenShift 4 rpm-ostree +2 2022.10.99.g0049dbdd-3.el8 RHSA-2022:7398
Red Hat OpenShift 4 runc 3:1.1.2-2.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 skopeo +1 2:1.8.0-1.rhaos4.12.el8 RHSA-2022:7398
Red Hat OpenShift 4 slirp4netns 1.1.8-1.rhaos4.11.el8 RHSA-2022:7398
Red Hat OpenShift 4 tini 0.16.1-1.el8ar RHSA-2022:7398
Red Hat OpenShift 4 toolbox 0.1.0-1.rhaos4.12.el8 RHSA-2022:7398

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 kubernetes1.23 1.23.17-150300.7.6.1 SUSE-SU-2023:2292-1
SLES 15 SP3 kubernetes1.23 1.23.17-150300.7.6.1 SUSE-SU-2023:2292-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP3 kubernetes1.23 1.23.17-150300.7.6.1 SUSE-SU-2023:2292-1
SLE HPC 15 SP3 kubernetes1.23 1.23.17-150300.7.6.1 SUSE-SU-2023:2292-1
SUSE Enterprise Storage 7.1 kubernetes1.23 1.23.17-150300.7.6.1 SUSE-SU-2023:2292-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed govulncheck-vulndb 0.0.20250807T150727-1.1 openSUSE-SU-2025:15424-1
openSUSE Tumbleweed kubernetes1.25 1.25.7-1.1 openSUSE-SU-2024:12810-1

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 keda 2.14.0-1 —
Azure Linux 2 (CBL-Mariner) cert-manager 1.11.2-1 —
Azure Linux 2 (CBL-Mariner) keda 2.4.0-29 —
Azure Linux 2 (CBL-Mariner) kube-vip-cloud-provider 0.0.2-21 —
Azure Linux 2 (CBL-Mariner) kubernetes 1.25.4-0 —
Azure Linux 2 (CBL-Mariner) prometheus-adapter 0.10.0-17 —
Azure Linux 2 (CBL-Mariner) rook 1.6.2-25 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 kubeadm +2 1.21.14-3.el8 ELSA-2022-10036, ELSA-2022-10034
Oracle Linux 8 olcne-metallb-chart +1 1.5.8-4.el8 ELSA-2022-10036
Oracle Linux 8 olcnectl +10 1.4.9-2.el8 ELSA-2022-10036, ELSA-2022-10034
Oracle Linux 7 kubeadm +2 1.21.14-3.el7 ELSA-2022-10035, ELSA-2022-10033
Oracle Linux 7 olcne-metallb-chart +1 1.5.8-4.el7 ELSA-2022-10035
Oracle Linux 7 olcnectl +10 1.4.9-2.el7 ELSA-2022-10035, ELSA-2022-10033

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/kubernetes/kubernetes >= 1.25.0, < 1.25.4 1.25.4 GHSA-2394-5535-8j88
Go github.com/kubernetes/kubernetes >= 1.24.0, < 1.24.8 1.24.8 GHSA-2394-5535-8j88
Go github.com/kubernetes/kubernetes >= 1.23.0, < 1.23.14 1.23.14 GHSA-2394-5535-8j88
Go github.com/kubernetes/kubernetes >= 1.22.0, < 1.22.16 1.22.16 GHSA-2394-5535-8j88
Go k8s.io/kubernetes >= 1.22.0, < 1.22.16 · >= 1.23.0, < 1.23.14 · >= 1.24.0, < 1.24.8 · >= 1.25.0, < 1.25.4 1.22.16, 1.23.14, 1.24.8, 1.25.4 GO-2023-1628

Advisories 10

References