TI-2022-00670 Aliases CVE-2022-0759 GHSA-69p3-xp37-f692

Improper certificate validation in kubeclient

LOW 37CWE-295Published 2022-03-25 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: High · High · High
Fix status: Partial Red Hat: 5 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.

Summary

A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).

Why it matters now

EPSS 0.00942 61st percentileScored 2026-11-07

Fix Partial kubeclient (RubyGems): 4.9.3Red Hat: 5 advisoriesRed Hat: 5 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	kubeclient	4.9.3	—	No fix listed	CNA
—	kubeclient (RubyGems)	before 4.9.3	4.9.3	Patch available	GHSA-69p3-xp37-f692

kubeclient Vendor— Affected 4.9.3 Fixed in — No fix listed CNA
kubeclient (RubyGems) Vendor— Affected before 4.9.3 Fixed in 4.9.3 Patch available GHSA-69p3-xp37-f692

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:redhat:kubeclient::::::ruby::*	before 4.9.3	Vulnerable	Red Hat

cpe:2.3:a:redhat:kubeclient:*:*:*:*:*:ruby:*:* Versions before 4.9.3 Vulnerable ·Red Hat

Remediation

Fix · GHSA-69p3-xp37-f692 kubeclient (RubyGems) Fixed in 4.9.3 Advisory →

Red Hat 5 advisories

RHSA-2023:6818 Released 2023-11-08 · Red Hat rating Important
Satellite 6.14 security and bug fix update
- Red Hat Satellite 6.14 for RHEL 8 foreman-3.7.0.9-1.el8sat, foreman-cli-3.7.0.9-1.el8sat, foreman-debug-3.7.0.9-1.el8sat +33
RHSA-2022:6051 Released 2022-08-18 · Red Hat rating Important
Logging Subsystem 5.5.0 - Red Hat OpenShift security update
- RHOL 5.5 for RHEL 8 openshift-logging/cluster-logging-rhel8-operator, openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator +6
RHSA-2022:2217 Released 2022-05-11 · Red Hat rating Moderate
Red Hat OpenShift Logging Security and Bug update Release 5.3.7
- OpenShift Logging 5.3 openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator, openshift-logging/elasticsearch6-rhel8 +1

Show 2 more Red Hat advisories

RHSA-2022:2218 Released 2022-05-11 · Red Hat rating Moderate
Openshift Logging Security and Bug update Release (5.2.10)
- OpenShift Logging 5.2 openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/elasticsearch-rhel8-operator, openshift-logging/elasticsearch6-rhel8 +1
RHSA-2022:1461 Released 2022-04-20 · Red Hat rating Important
Logging Subsystem 5.4 - Red Hat OpenShift Security and Bug update
- RHOL 5.4 for RHEL 8 openshift-logging/elasticsearch-proxy-rhel8, openshift-logging/fluentd-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Container Platform 3.11	Affected	No fix planned: Will not fix
Red Hat OpenShift GitOps	Affected	No fix planned: Will not fix
OpenShift Logging 5.2	Fixed	RHSA-2022:2218
OpenShift Logging 5.3	Fixed	RHSA-2022:2217
RHOL 5.4 for RHEL 8	Fixed	RHSA-2022:1461
RHOL 5.5 for RHEL 8	Fixed	RHSA-2022:6051
Red Hat Satellite 6.14 for RHEL 8	Fixed	RHSA-2023:6818

Not affected: 7 products

Logging Subsystem for Red Hat OpenShift
OpenShift Logging 5.2
OpenShift Logging 5.3
OpenShift Service Mesh 2.1
RHOL 5.4 for RHEL 8
RHOL 5.5 for RHEL 8
Red Hat Satellite 6.14 for RHEL 8

Timeline

2026-10-02 Threatist record created from CVE-2022-0759
2026-10-03 Alias added: GHSA-69p3-xp37-f692

References

Patch 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2022-0759

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences