x/vulndb: potential Go vuln in github.com/kyverno/kyverno: CVE-2023-34091

[GoVulnBot]

CVE-2023-34091 references github.com/kyverno/kyverno, which may be a Go module.

Description:
Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the deletionTimestamp field defined can bypass validate, generate, or mutate-existing policies, even in cases where the validationFailureAction field is set to Enforce. This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the deletionTimestamp and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This is resolved in Kyverno 1.10.0. There is no known workaround.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2023-34091
• JSON: https://github.com/CVEProject/cvelist/tree/32f8c34d56eccac90e5c3eb856c0887638b9b3bc/2023/34xxx/CVE-2023-34091.json
• advisory: GHSA-hq4m-4948-64cc
• web: https://github.com/kyverno/kyverno/releases/tag/v1.10.0
• Imported by: https://pkg.go.dev/github.com/kyverno/kyverno?tab=importedby

Cross references:

• Module github.com/kyverno/kyverno appears in issue x/vulndb: potential Go vuln in github.com/kyverno/kyverno: GHSA-m3cq-xcx9-3gvm #1180

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/kyverno/kyverno
      packages:
        - package: kyverno
description: |
    Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0, resources which have the `deletionTimestamp` field defined can bypass validate, generate, or mutate-existing policies, even in cases where the `validationFailureAction` field is set to `Enforce`. This situation occurs as resources pending deletion were being consciously exempted by Kyverno, as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However, this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the `deletionTimestamp` and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but, as an example, a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This is resolved in Kyverno 1.10.0. There is no known workaround.
cves:
    - CVE-2023-34091
references:
    - advisory: https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64cc
    - web: https://github.com/kyverno/kyverno/releases/tag/v1.10.0

[gopherbot]

Change https://go.dev/cl/500496 mentions this issue: data/excluded: batch add 9 excluded reports

[gopherbot]

Change https://go.dev/cl/592761 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606786 mentions this issue: data/reports: unexclude 20 reports (6)