Moderate severityNVD Advisory· Published Aug 29, 2022· Updated Aug 3, 2024
CVE-2022-31677
CVE-2022-31677
Description
An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
go.pinniped.devGo | >= 0.3.0, < 0.19.0 | 0.19.0 |
Affected products
3- Pinniped Supervisor/Pinniped Supervisordescription
- osv-coords2 versions
>= 0.3.0, < 0.19.0+ 1 more
- (no CPE)range: >= 0.3.0, < 0.19.0
- (no CPE)range: >= 0.3.0, < 0.19.0
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-rp4v-hhm6-rcv9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-31677ghsaADVISORY
- github.com/vmware-tanzu/pinniped/pull/1264ghsaWEB
- github.com/vmware-tanzu/pinniped/releases/tag/v0.19.0ghsaWEB
- github.com/vmware-tanzu/pinniped/security/advisories/GHSA-rp4v-hhm6-rcv9ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.