CVE-2023-33191: kyverno seccomp control can be circumvented

Impact

Users of the podSecurity (validate.podSecurity) subrule in Kyverno 1.9. See the documentation for information on this subrule type. Users of Kyverno v1.9.2 and v1.9.3 are affected.

Patches

v1.9.4 v1.10.0

Workarounds

To work around this issue without upgrading to v1.9.4, temporarily install individual policies for the respective Seccomp checks in baseline here and restricted here.

References

References

Code Behaviors & Features

Detect and mitigate CVE-2023-33191 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →