CVE-2022-4886, CVE-2023-5043, and CVE-2023-5044
This document (000021265) is provided subject to the disclaimer at the end of this document.
As of writing this KB article, three CVEs were made public on October 25th, 2023, in Nginx ingress: CVE-2022-4886, CVE-2023-5043, and CVE-2023-5044. Here at SUSE Rancher, we are deeply committed to safeguarding the security of our products and endeavor to resolve security issues in a timely manner.
Please note that if you do not run a multi-tenant environment(s) and do not allow non-privileged users to create/edit Ingress objects, then you are likely to be safe (unless other unknown attack vectors exist outside those mentioned in the public upstream advisories).
Mentioned in the upstream Kubernetes GitHub issues, to address CVE-2023-5043 and CVE-2023-5044:
These CVEs affect versions v1.9.0 and lower
- Ingress Administrators should set the --enable-annotation-validation flag to enforce restrictions on the contents of ingress-nginx annotation fields.
In regards to CVE-2022-4886:
This CVE affects versions v1.8.0 and lower
- Ingress objects contain a field called pathType that defines the proxy behavior. It can be Exact, Prefix, and ImplementationSpecific.
- When pathType is configured as Exact or Prefix, there is more strict validation, allowing only paths starting with "/" and containing only alphanumeric characters and "-", "_" and additional "/".
- When this option is enabled, the validation happens in the Admission Webhook, denying creation of any Ingress containing invalid characters (unless pathType is ImplementationSpecific).
- Ingress Admins should enable this validation by default. If you still need to allow implementation specific paths due to the usage of features like Regex/rewrite on path, we recommend implementing countermeasures to allow just trusted users to consume this feature, as an example with OPA: https://kubernetes.github.io/ingress-nginx/examples/openpolicyagent/
As of writing this, RKE2 images have been released to address CVE-2023-5043 and CVE-2023-5044 and can be found in the following versions:
- >= v1.25.15+rke2r1
- >= v1.26.10+rke2r1
- >= v1.27.7+rke2r1
- >= v1.28.3+rke2r1
Please check the release section for RKE and RKE2 to ensure the latest release includes these patches for the mentioned CVEs:
For more information about our security policy and posted advisories, please check out our security section in the rancher/rancher GitHub repo:
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:000021265
- Creation Date: 07-Nov-2023
- Modified Date:07-Nov-2023
- SUSE Rancher
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com