CVE-2022-47633

Vulnerability

Description CVE-2022-47633 is an image signature validation bypass in Kyverno versions 1.8.3 and 1.8.4. The flaw allows an attacker to inject unsigned arbitrary container images into a protected Kubernetes cluster by exploiting a weakness in how Kyverno validates image signatures [1].

Exploitation

Scenario A malicious image registry or a man-in-the-middle attacker can exploit this vulnerability to bypass signature verification. The attack does not require authentication to Kyverno, but requires the ability to intercept or control image pulls [1].

Impact

Successful exploitation results in the deployment of unsigned container images within the cluster, potentially undermining supply chain security and allowing unauthorized code execution [1].

Mitigation

The vulnerability is fixed in Kyverno version 1.8.5 [2]. The fix addresses the signature validation logic and was applied in commits linked to the release [3][4]. Users of affected versions should upgrade immediately; mitigation steps are available for impacted releases [1].