CVE-2022-0759

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published: Mar 25, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-07609.8The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statemen CVE-2022-07624.3Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.CVE-2022-07634.8Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.CVE-2022-07646.7Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.CVE-2022-07655.4The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings befo CVE-2022-07669.8Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.CVE-2022-07679.9Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17.CVE-2022-07689.1Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2.CVE-2022-07699.8The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolat CVE-2022-07708.8The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as u CVE-2022-07719.8The SiteSuperCharger WordPress plugin before 5.2.0 does not validate, sanitise and escape various user inputs before using them in SQL state CVE-2022-07724.8Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2.