Bug 871741 (CVE-2022-3172)

Summary:	<sys-cluster/kube-apiserver-1.22.14,1.23.11,1.24.5,1.25.1}: SSRF
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	williamh
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://www.openwall.com/lists/oss-security/2022/09/16/1
Whiteboard:	B4 [noglsa]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-09-19 16:28:07 UTC

"A security issue was discovered in kube-apiserver that allows an aggregated
API server to redirect client traffic to any URL. This could lead to the
client performing unexpected actions as well as forwarding the client's API
server credentials to third parties."

Please bump to 1.22.14, 1.23.11, 1.24.5, and 1.25.1.

Comment 1 William Hubbs gentoo-dev

2022-10-15 18:55:57 UTC

This is bumped and cleaned up.

Comment 2 John Helmert III archtester

2022-10-15 19:30:44 UTC

Thanks!

Comment 3 John Helmert III archtester

2023-12-03 23:09:53 UTC

Naturally complex to exploit as this kubernetes - no GLSA.