{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6FFC1CCB-8B49-48E4-8061-C7E17C6CD091",
                     versionEndExcluding: "1.10.5",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "Kyverno is a policy engine designed for Kubernetes. An issue was found in Kyverno that allowed an attacker to control the digest of images used by Kyverno users. The issue would require the attacker to compromise the registry that the Kyverno users fetch their images from. The attacker could then return an vulnerable image to the the user and leverage that to further escalate their position. As such, the attacker would need to know which images the Kyverno user consumes and know of one of multiple exploitable vulnerabilities in previous digests of the images. Alternatively, if the attacker has compromised the registry, they could craft a malicious image with a different digest with intentionally placed vulnerabilities and deliver the image to the user.  Users pulling their images by digests and from trusted registries are not impacted by this vulnerability. There is no evidence of this being exploited in the wild. The issue has been patched in 1.10.5. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
      },
      {
         lang: "es",
         value: "Kyverno es un motor de políticas manipulado para Kubernetes. Se encontró un problema en Kyverno que permitió a un atacante controlar el resumen de imágenes utilizadas por los usuarios de Kyverno. El problema requeriría que el atacante comprometiera el registro del que los usuarios de Kyverno obtienen sus imágenes. Luego, el atacante podría devolver una imagen vulnerable al usuario y aprovecharla para escalar aún más su posición. Como tal, el atacante necesitaría saber qué imágenes consume el usuario de Kyverno y conocer una de las múltiples vulnerabilidades explotables en resúmenes anteriores de las imágenes. Alternativamente, si el atacante ha comprometido el registro, podría crear una imagen maliciosa con un resumen diferente con vulnerabilidades colocadas intencionalmente y entregar la imagen al usuario. Los usuarios que extraen sus imágenes de resúmenes y de registros confiables no se ven afectados por esta vulnerabilidad. No hay evidencia de que esto haya sido explotado en la naturaleza. El problema se solucionó en 1.10.5. Se recomienda a todos los usuarios que actualicen. No se conocen workarounds para esta vulnerabilidad.",
      },
   ],
   id: "CVE-2023-47630",
   lastModified: "2024-11-21T08:30:34.003",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.2,
            impactScore: 5.9,
            source: "security-advisories@github.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.2,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-11-14T21:15:13.037",
   references: [
      {
         source: "security-advisories@github.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-3hfq-cx9j-923w",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-3hfq-cx9j-923w",
      },
   ],
   sourceIdentifier: "security-advisories@github.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-345",
            },
         ],
         source: "security-advisories@github.com",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:kyverno:kyverno:1.8.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "0D729B50-5AE9-4D29-8D58-FE477B5019E6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:kyverno:kyverno:1.8.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "71A13850-26FF-4699-9042-79F8DCA156B3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This has been fixed in 1.8.5 and mitigations are available for impacted releases.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad de omisión de validación de firma de imagen en Kyverno 1.8.3 y 1.8.4 permite que un registro de imágenes malicioso (o un atacante intermediario) inyecte imágenes de contenedores arbitrarias sin firmar en un clúster de Kubernetes protegido. Esto se solucionó en 1.8.5. Esto se solucionó en 1.8.5 y hay mitigaciones disponibles para las versiones afectadas.",
      },
   ],
   id: "CVE-2022-47633",
   lastModified: "2024-11-21T07:32:17.477",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 2.2,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2022-12-23T23:15:08.973",
   references: [
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/kyverno/kyverno/compare/v1.8.4...v1.8.5",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/kyverno/kyverno/pull/5713",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Release Notes",
            "Third Party Advisory",
         ],
         url: "https://github.com/kyverno/kyverno/releases/tag/v1.8.5",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvm",
      },
      {
         source: "cve@mitre.org",
         tags: [
            "Product",
         ],
         url: "https://kyverno.io/docs/writing-policies/verify-images/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/kyverno/kyverno/compare/v1.8.4...v1.8.5",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/kyverno/kyverno/pull/5713",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Release Notes",
            "Third Party Advisory",
         ],
         url: "https://github.com/kyverno/kyverno/releases/tag/v1.8.5",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Patch",
            "Third Party Advisory",
         ],
         url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvm",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Product",
         ],
         url: "https://kyverno.io/docs/writing-policies/verify-images/",
      },
   ],
   sourceIdentifier: "cve@mitre.org",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-287",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:kyverno:kyverno:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "kyverno",
                  vendor: "kyverno",
                  versions: [
                     {
                        lessThan: "1.13.0",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-48921",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "yes",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-10-29T14:57:32.532882Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-10-29T14:58:36.597Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "kyverno",
               vendor: "kyverno",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.13.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Kyverno is a policy engine designed for Kubernetes. A kyverno ClusterPolicy, ie. \"disallow-privileged-containers,\" can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace. Administrators may not recognize that this allows users with privileges to non-kyverno namespaces to create exceptions. This vulnerability is fixed in 1.13.0.",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  attackComplexity: "LOW",
                  attackRequirements: "NONE",
                  attackVector: "NETWORK",
                  baseScore: 8.7,
                  baseSeverity: "HIGH",
                  privilegesRequired: "NONE",
                  subAvailabilityImpact: "NONE",
                  subConfidentialityImpact: "NONE",
                  subIntegrityImpact: "NONE",
                  userInteraction: "NONE",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
                  version: "4.0",
                  vulnAvailabilityImpact: "NONE",
                  vulnConfidentialityImpact: "NONE",
                  vulnIntegrityImpact: "HIGH",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-285",
                     description: "CWE-285: Improper Authorization",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-10-29T14:14:36.260Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-qjvc-p88j-j9rm",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-qjvc-p88j-j9rm",
            },
         ],
         source: {
            advisory: "GHSA-qjvc-p88j-j9rm",
            discovery: "UNKNOWN",
         },
         title: "Kyverno's PolicyException objects can be created in any namespace by default",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2024-48921",
      datePublished: "2024-10-29T14:14:36.260Z",
      dateReserved: "2024-10-09T22:06:46.173Z",
      dateUpdated: "2024-10-29T14:58:36.597Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T19:30:24.296Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-9g37-h7p2-2c6r",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-9g37-h7p2-2c6r",
               },
               {
                  name: "https://github.com/kyverno/kyverno/pull/8428",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/pull/8428",
               },
               {
                  name: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
               },
               {
                  name: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "kyverno",
               vendor: "kyverno",
               versions: [
                  {
                     status: "affected",
                     version: ">= 80d139bb5d1d9d7e907abe851b97dc73821a5be2, < fec2992e3f9fcd6b9c62267522c09b182e7df73b",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerable component in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch attestations. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild.\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 3.1,
                  baseSeverity: "LOW",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-835",
                     description: "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-11-14T18:51:24.873Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-9g37-h7p2-2c6r",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-9g37-h7p2-2c6r",
            },
            {
               name: "https://github.com/kyverno/kyverno/pull/8428",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/pull/8428",
            },
            {
               name: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
            },
            {
               name: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
            },
         ],
         source: {
            advisory: "GHSA-9g37-h7p2-2c6r",
            discovery: "UNKNOWN",
         },
         title: "Denial of service from malicious image manifest in kyverno",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2023-42814",
      datePublished: "2023-11-13T20:34:05.257Z",
      dateReserved: "2023-09-14T16:13:33.308Z",
      dateUpdated: "2024-08-02T19:30:24.296Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T21:16:42.282Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-3hfq-cx9j-923w",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-3hfq-cx9j-923w",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-47630",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-11-27T16:13:56.239908Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-11-27T16:14:09.547Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "kyverno",
               vendor: "kyverno",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.10.5",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Kyverno is a policy engine designed for Kubernetes. An issue was found in Kyverno that allowed an attacker to control the digest of images used by Kyverno users. The issue would require the attacker to compromise the registry that the Kyverno users fetch their images from. The attacker could then return an vulnerable image to the the user and leverage that to further escalate their position. As such, the attacker would need to know which images the Kyverno user consumes and know of one of multiple exploitable vulnerabilities in previous digests of the images. Alternatively, if the attacker has compromised the registry, they could craft a malicious image with a different digest with intentionally placed vulnerabilities and deliver the image to the user.  Users pulling their images by digests and from trusted registries are not impacted by this vulnerability. There is no evidence of this being exploited in the wild. The issue has been patched in 1.10.5. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-345",
                     description: "CWE-345: Insufficient Verification of Data Authenticity",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-11-14T20:59:46.100Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-3hfq-cx9j-923w",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-3hfq-cx9j-923w",
            },
         ],
         source: {
            advisory: "GHSA-3hfq-cx9j-923w",
            discovery: "UNKNOWN",
         },
         title: "Attacker can cause Kyverno user to unintentionally consume insecure image",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2023-47630",
      datePublished: "2023-11-14T20:59:46.100Z",
      dateReserved: "2023-11-07T16:57:49.244Z",
      dateUpdated: "2024-11-27T16:14:09.547Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T15:39:35.695Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3c",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3c",
               },
               {
                  name: "https://github.com/kyverno/kyverno/pull/7263",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/pull/7263",
               },
               {
                  name: "https://github.com/kyverno/kyverno/releases/tag/v1.9.4",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/releases/tag/v1.9.4",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-33191",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-10T19:00:22.599496Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-10T19:00:31.962Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "kyverno",
               vendor: "kyverno",
               versions: [
                  {
                     status: "affected",
                     version: ">= 1.9.2, < 1.9.4",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Kyverno is a policy engine designed for Kubernetes. Kyverno seccomp control can be circumvented. Users of the podSecurity `validate.podSecurity` subrule in Kyverno 1.9.2 and 1.9.3 are vulnerable. This issue was patched in version 1.9.4.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 4.6,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-284",
                     description: "CWE-284: Improper Access Control",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-05-30T06:06:14.987Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3c",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-33hq-f2mf-jm3c",
            },
            {
               name: "https://github.com/kyverno/kyverno/pull/7263",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/pull/7263",
            },
            {
               name: "https://github.com/kyverno/kyverno/releases/tag/v1.9.4",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/releases/tag/v1.9.4",
            },
         ],
         source: {
            advisory: "GHSA-33hq-f2mf-jm3c",
            discovery: "UNKNOWN",
         },
         title: "kyverno seccomp control can be circumvented",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2023-33191",
      datePublished: "2023-05-30T06:06:14.987Z",
      dateReserved: "2023-05-17T22:25:50.699Z",
      dateUpdated: "2025-01-10T19:00:31.962Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T16:01:53.601Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64cc",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64cc",
               },
               {
                  name: "https://github.com/kyverno/kyverno/releases/tag/v1.10.0",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/releases/tag/v1.10.0",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-34091",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-08T21:32:38.963338Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-08T21:32:51.451Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "kyverno",
               vendor: "kyverno",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.10.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction` field is set to `Enforce`. This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the `deletionTimestamp` and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This is resolved in Kyverno 1.10.0. There is no known workaround.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-285",
                     description: "CWE-285: Improper Authorization",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-06-01T16:24:53.920Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64cc",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64cc",
            },
            {
               name: "https://github.com/kyverno/kyverno/releases/tag/v1.10.0",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/releases/tag/v1.10.0",
            },
         ],
         source: {
            advisory: "GHSA-hq4m-4948-64cc",
            discovery: "UNKNOWN",
         },
         title: "Kyverno resource with a deletionTimestamp may allow policy circumvention",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2023-34091",
      datePublished: "2023-06-01T16:24:53.920Z",
      dateReserved: "2023-05-25T21:56:51.244Z",
      dateUpdated: "2025-01-08T21:32:51.451Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T19:30:24.650Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-hjpv-68f4-2262",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-hjpv-68f4-2262",
               },
               {
                  name: "https://github.com/kyverno/kyverno/pull/8428",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/pull/8428",
               },
               {
                  name: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
               },
               {
                  name: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "kyverno",
               vendor: "kyverno",
               versions: [
                  {
                     status: "affected",
                     version: ">= 80d139bb5d1d9d7e907abe851b97dc73821a5be2, < fec2992e3f9fcd6b9c62267522c09b182e7df73b",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch signatures. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "LOW",
                  baseScore: 3.1,
                  baseSeverity: "LOW",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-835",
                     description: "CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-11-14T18:53:14.598Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-hjpv-68f4-2262",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-hjpv-68f4-2262",
            },
            {
               name: "https://github.com/kyverno/kyverno/pull/8428",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/pull/8428",
            },
            {
               name: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
            },
            {
               name: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
            },
         ],
         source: {
            advisory: "GHSA-hjpv-68f4-2262",
            discovery: "UNKNOWN",
         },
         title: "Denial of service from malicious image manifest in kyverno",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2023-42815",
      datePublished: "2023-11-13T20:33:24.955Z",
      dateReserved: "2023-09-14T16:13:33.308Z",
      dateUpdated: "2024-08-02T19:30:24.650Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T19:30:23.998Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-wc3x-5rfv-hh5v",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-wc3x-5rfv-hh5v",
               },
               {
                  name: "https://github.com/kyverno/kyverno/pull/8428",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/pull/8428",
               },
               {
                  name: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
               },
               {
                  name: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "kyverno",
               vendor: "kyverno",
               versions: [
                  {
                     status: "affected",
                     version: ">= 80d139bb5d1d9d7e907abe851b97dc73821a5be2, < fec2992e3f9fcd6b9c62267522c09b182e7df73b",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerable component in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch attestations. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-400",
                     description: "CWE-400: Uncontrolled Resource Consumption",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-11-14T18:50:11.424Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-wc3x-5rfv-hh5v",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-wc3x-5rfv-hh5v",
            },
            {
               name: "https://github.com/kyverno/kyverno/pull/8428",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/pull/8428",
            },
            {
               name: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
            },
            {
               name: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
            },
         ],
         source: {
            advisory: "GHSA-wc3x-5rfv-hh5v",
            discovery: "UNKNOWN",
         },
         title: "Denial of service from malicious manifest in kyverno",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2023-42813",
      datePublished: "2023-11-13T20:34:23.826Z",
      dateReserved: "2023-09-14T16:13:33.308Z",
      dateUpdated: "2024-08-02T19:30:23.998Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2025-29778",
                        options: [
                           {
                              Exploitation: "poc",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-03-24T17:55:17.656781Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-03-24T17:55:28.379Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "kyverno",
               vendor: "kyverno",
               versions: [
                  {
                     status: "affected",
                     version: "< 1.14.0-alpha.1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 5.8,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-285",
                     description: "CWE-285: Improper Authorization",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2025-03-24T16:38:08.104Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-46mp-8w32-6g94",
            },
            {
               name: "https://github.com/kyverno/policies/issues/1246",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/policies/issues/1246",
            },
            {
               name: "https://github.com/kyverno/kyverno/pull/12237",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/pull/12237",
            },
            {
               name: "https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/commit/8777672fb17bdf252bd2e7d8de3441e240404a60",
            },
            {
               name: "https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/Mohdcode/kyverno/blob/373f942ea9fa8b63140d0eb0e101b9a5f71033f3/pkg/cosign/cosign.go#L537",
            },
         ],
         source: {
            advisory: "GHSA-46mp-8w32-6g94",
            discovery: "UNKNOWN",
         },
         title: "Kyverno ignores subjectRegExp and IssuerRegExp",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2025-29778",
      datePublished: "2025-03-24T16:38:08.104Z",
      dateReserved: "2025-03-11T14:23:00.475Z",
      dateUpdated: "2025-03-24T17:55:28.379Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T19:30:24.686Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-4mp4-46gq-hv3r",
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-4mp4-46gq-hv3r",
               },
               {
                  name: "https://github.com/kyverno/kyverno/pull/8428",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/pull/8428",
               },
               {
                  name: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
               },
               {
                  name: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "kyverno",
               vendor: "kyverno",
               versions: [
                  {
                     status: "affected",
                     version: ">= 80d139bb5d1d9d7e907abe851b97dc73821a5be2, < fec2992e3f9fcd6b9c62267522c09b182e7df73b",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Kyverno is a policy engine designed for Kubernetes. A security vulnerability was found in Kyverno where an attacker could cause denial of service of Kyverno. The vulnerability was in Kyvernos Notary verifier. An attacker would need control over the registry from which Kyverno would fetch signatures. With such a position, the attacker could return a malicious response to Kyverno, when Kyverno would send a request to the registry. The malicious response would cause denial of service of Kyverno, such that other users' admission requests would be blocked from being processed. This is a vulnerability in a new component released in v1.11.0. The only users affected by this are those that have been building Kyverno from source at the main branch which is not encouraged. Users consuming official Kyverno releases are not affected. There are no known cases of this vulnerability being exploited in the wild.",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "HIGH",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 6.1,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "NONE",
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "CHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:N/A:H",
                  version: "3.1",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-345",
                     description: "CWE-345: Insufficient Verification of Data Authenticity",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-11-14T18:54:09.977Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/kyverno/kyverno/security/advisories/GHSA-4mp4-46gq-hv3r",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-4mp4-46gq-hv3r",
            },
            {
               name: "https://github.com/kyverno/kyverno/pull/8428",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/pull/8428",
            },
            {
               name: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/commit/80d139bb5d1d9d7e907abe851b97dc73821a5be2",
            },
            {
               name: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/kyverno/kyverno/commit/fec2992e3f9fcd6b9c62267522c09b182e7df73b",
            },
         ],
         source: {
            advisory: "GHSA-4mp4-46gq-hv3r",
            discovery: "UNKNOWN",
         },
         title: "Denial of service from malicious signature in kyverno",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2023-42816",
      datePublished: "2023-11-13T20:23:16.248Z",
      dateReserved: "2023-09-14T16:13:33.308Z",
      dateUpdated: "2024-08-02T19:30:24.686Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T15:02:36.144Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://kyverno.io/docs/writing-policies/verify-images/",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/compare/v1.8.4...v1.8.5",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/releases/tag/v1.8.5",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/pull/5713",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvm",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This has been fixed in 1.8.5 and mitigations are available for impacted releases.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-12-23T00:00:00",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               url: "https://kyverno.io/docs/writing-policies/verify-images/",
            },
            {
               url: "https://github.com/kyverno/kyverno/compare/v1.8.4...v1.8.5",
            },
            {
               url: "https://github.com/kyverno/kyverno/releases/tag/v1.8.5",
            },
            {
               url: "https://github.com/kyverno/kyverno/pull/5713",
            },
            {
               url: "https://github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvm",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2022-47633",
      datePublished: "2022-12-23T00:00:00",
      dateReserved: "2022-12-20T00:00:00",
      dateUpdated: "2024-08-03T15:02:36.144Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}