CVE-2023-34091 Information

Description

Kyverno is a policy engine designed for Kubernetes. In versions of Kyverno prior to 1.10.0 resources which have the deletionTimestamp field defined can bypass validate generate or mutate-existing policies even in cases where the validationFailureAction field is set to Enforce. This situation occurs as resources pending deletion were being consciously exempted by Kyverno as a way to reduce processing load as policies are typically not applied to objects which are being deleted. However this could potentially result in allowing a malicious user to leverage the Kubernetes finalizers feature by setting a finalizer which causes the Kubernetes API server to set the deletionTimestamp and then not completing the delete operation as a way to explicitly to bypass a Kyverno policy. Note that this is not applicable to Kubernetes Pods but as an example a Kubernetes Service resource can be manipulated using an indefinite finalizer to bypass policies. This is resolved in Kyverno 1.10.0. There is no known workaround.

Reference

https://github.com/kyverno/kyverno/releases/tag/v1.10.0 https://github.com/kyverno/kyverno/security/advisories/GHSA-hq4m-4948-64cc