GHSA-33hq-f2mf-jm3c

kyverno seccomp control can be circumvented

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-33191

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/kyverno/kyverno	>= 1.9.2, < 1.9.4	1.9.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Users of the podSecurity (`validate.podSecurity`) subrule in Kyverno versions v1.9.2 and v1.9.3 may be unable to enforce the check for the Seccomp control at the baseline level when using a `version` value of `latest`. There is no effect if a version number is referenced instead. See the [documentation](https://kyverno.io/docs/writing-policies/validate/#pod-security) for information on this subrule type. Users of Kyverno v1.9.2 and v1.9.3 are affected. ### Patches v1.9.4 v1.10.0 ### Workarounds To work around this issue without upgrading to v1.9.4, temporarily install individual policies for the respective Seccomp checks in baseline [here](https://kyverno.io/policies/pod-security/baseline/restrict-seccomp/restrict-seccomp/) and restricted [here](https://kyverno.io/policies/pod-security/restricted/restrict-seccomp-strict/restrict-seccomp-strict/). ### References * https://kyverno.io/docs/writing-policies/validate/#pod-security * https://github.com/kyverno/kyverno/pull/7263

References

External links from the advisory. They lead to third-party sites.