CVE-2024-48921: Kyverno's PolicyException objects can be created in any namespace by default

October 29, 2024 (updated November 7, 2024)

A kyverno ClusterPolicy, ie. “disallow-privileged-containers,” can be overridden by the creation of a PolicyException in a random namespace.

References

github.com/advisories/GHSA-qjvc-p88j-j9rm
github.com/kyverno/kyverno
github.com/kyverno/kyverno/security/advisories/GHSA-qjvc-p88j-j9rm
nvd.nist.gov/vuln/detail/CVE-2024-48921

Code Behaviors & Features

Detect and mitigate CVE-2024-48921 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →