Kong KIC CVE-2024-15228 Cluster DoS via CA-Cert Injection

Vulnerability Overview A vulnerability exists in Kong Kubernetes Ingress Controller (KIC) that allows users with namespace-scoped Secret creation permissions to inject into the cluster-wide Kong CA-cert pool, resulting in a cluster-wide configuration synchronization Denial of Service (DoS). Scope of Impact Affected Versions: KIC versions less than 3.4.10 or 3.4.17 Fixed Versions: KIC version 3.4.18 or 3.5.11 Remediation 1. Restrict watch scope: Set (or environment variable ) to include only trusted namespaces. This prevents the embedded KIC from extracting Secrets from untrusted namespaces. 2. Restrict Secret labels via RBAC: Use Kubernetes RBAC to prevent untrusted users from creating or modifying Secrets tagged with . Consider using admission webhooks or OPA/Kyverno policies to enforce this label restriction. 3. Audit existing CA-cert Secrets: Inspect Secrets marked with and look for unexpected or duplicate values across all watched namespaces. Remove any that were not provided by trusted operators. Remediation Code Additional Information CVSS 4.0 Score: 7.1 (High) CVE ID: CVE-2024-15228 Weaknesses: - CWE-400 - CWE-862 Summary This vulnerability allows users with namespace-scoped Secret creation permissions to inject into the cluster-wide Kong CA-cert pool, causing a cluster-wide configuration synchronization Denial of Service. Remediation measures include restricting the watch scope, restricting Secret labels via RBAC, and auditing existing CA-cert Secrets. Users should upgrade to the patched versions (3.4.18 or 3.5.11).

Goal Reached Thanks to every supporter — we hit 100%!

Kong KIC CVE-2024-15228 Cluster DoS via CA-Cert Injection

More from this source