Lucene search
GoogleOSV:GHSA-9CWV-CPPX-MQJMHistoryFeb 23, 2022 - 9:17 p.m.
Improper Authentication in Capsule Proxy
2022-02-2321:17:25
Google
osv.dev
16
0.003 Low
EPSS
Percentile
69.0%
Impact
Using a malicious Connection header, an attacker with a proper authentication mechanism could start a privilege escalation towards the Kubernetes API Server, being able to exploit the cluster-admin Role bound to capsule-proxy.
Patches
Patch has been merged in the v0.2.1 release.
Workarounds
Upgrading is mandatory.
| CPE | Name | Operator | Version |
|---|---|---|---|
| github.com/clastix/capsule-proxy | lt | 0.2.1 |
Related
cve
cve
CVE-2022-23652
2022-02-22 20:15:07
cvelist
cvelist
CVE-2022-23652 Privilege escalation using hop-by-hop Connection header
2022-02-22 19:55:11
veracode
veracode
Privilege Escalation
2022-02-28 07:59:46
osv
osv
CVE-2022-23652
2022-02-22 20:15:07
prion
prion
Design/Logic Flaw
2022-02-22 20:15:00
nvd
nvd
CVE-2022-23652
2022-02-22 20:15:07
github
github
Improper Authentication in Capsule Proxy
2022-02-23 21:17:25