Critical Security Flaw in ruby-kubeclient: Man-in-the-Middle Vulnerability
Summary
UBUNTU-CVE-2022-0759: A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. Affects ruby-kubeclient versions 2.3.0-2 – 3.0.0-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ruby-kubeclient is a Ruby client library designed for interacting with the Kubernetes REST API. It allows developers to manage Kubernetes resources programmatically. The library is widely used in applications that require Kubernetes integration. However, it has been found to have a significant security flaw that affects its ability to properly validate certificates in kubeconfig files.
Vulnerability Detail
A flaw was discovered in all versions of kubeclient up to (but not including) v4.9.3, where the library improperly parses kubeconfig files. If a kubeconfig file does not specify a custom Certificate Authority (CA) for certificate verification, kubeclient defaults to accepting any certificate, effectively returning VERIFY_NONE. This vulnerability exposes Ruby applications that utilize kubeclient to potential Man-in-the-Middle (MITM) attacks, allowing an attacker to intercept and manipulate communications between the application and the Kubernetes API.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually specify a custom CA in their kubeconfig files to enforce certificate validation. This can be done by adding the following lines to the kubeconfig file:
clusters:
- cluster:
certificate-authority: /path/to/ca.crt
server: https://your-kubernetes-api-server
name: your-cluster-name
Conclusion
The ruby-kubeclient library has a critical vulnerability that can lead to serious security risks if not addressed. Users are strongly advised to update to the latest version to mitigate the risk of Man-in-the-Middle attacks. Additionally, implementing a custom CA in kubeconfig files can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for ruby-kubeclient →
FAQ
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
All versions of ruby-kubeclient up to (but not including) v4.9.3 are affected by this vulnerability.
If exploited, this vulnerability could allow attackers to perform Man-in-the-Middle attacks, intercepting and altering communications between the application and the Kubernetes API.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for ruby-kubeclient.
