CVE-2023-34091
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
Kyverno, a policy engine designed for Kubernetes, in versions prior to 1.10.0 allowed resources with the `deletionTimestamp` field defined to bypass validation, generation, or mutation policies. Resources pending deletion were consciously exempted from processing, which could enable malicious users to manipulate policies.
Risk Assessment
The organization may be at risk of attacks where malicious users exploit the Kubernetes finalizers feature to bypass Kyverno policies, potentially leading to unauthorized access or manipulation of resources.
Recommendation
It is recommended to upgrade Kyverno to version 1.10.0 or later to mitigate this vulnerability. Additionally, security policies in Kubernetes should be reviewed and adjusted.
Original NVD description (English source)
Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction` field is set to `Enforce`. This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the `deletionTimestamp` and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This is resolved in Kyverno 1.10.0. There is no known workaround.