[<prev] [next>] [day] [month] [year] [list]
Message-ID: <C5315523-3149-4845-9560-36D35AD65D2B@amazon.com>
Date: Mon, 11 Jul 2022 16:42:12 +0000
From: "Hausler, Micah" <mhausler@...zon.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: [kubernetes] CVE-2022-2385: aws-iam-authenticator AccessKeyID
validation bypass
Hello Kubernetes Community,
A security issue was discovered in aws-iam-authenticator where an allow-listed IAM identity may be able to modify their username and escalate privileges.
This issue has been rated high (https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), and assigned CVE-2022-2385
Am I vulnerable?
Users are only affected if they use the AccessKeyID template parameter to construct a username and provide different levels of access based on the username.
Affected Versions
v0.5.2 - v0.5.8
How do I mitigate this vulnerability?
Upgrading to v0.5.9 mitigates this vulnerability.
Prior to upgrading, this vulnerability can be mitigated by not using the {{AccessKeyID}} template value to construct usernames.
Fixed Versions
aws-iam-authenticator v0.5.9
Detection
This issue affected the logged identity, and is not discernible from valid requests.
Additional Details
See the GitHub issue for more details: https://github.com/kubernetes-sigs/aws-iam-authenticator/issues/472
Acknowledgements
This vulnerability was reported by Gafnit Amiga from Lightspin
Micah Hausler
Principal Engineer
Amazon Web Services
Content of type "text/html" skipped
Download attachment "smime.p7s" of type "application/pkcs7-signature" (4700 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
