[DRE-maint] Bug#1014780: ruby-kubeclient: CVE-2022-0759

[Moritz Mühlenhoff]

Source: ruby-kubeclient
X-Debbugs-CC: team at security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerability was published for ruby-kubeclient.

CVE-2022-0759[0]:
| A flaw was found in all versions of kubeclient up to (but not
| including) v4.9.3, the Ruby client for Kubernetes REST API, in the way
| it parsed kubeconfig files. When the kubeconfig file does not
| configure custom CA to verify certs, kubeclient ends up accepting any
| certificate (it wrongly returns VERIFY_NONE). Ruby applications that
| leverage kubeclient to parse kubeconfig files are susceptible to Man-
| in-the-middle attacks (MITM).

https://bugzilla.redhat.com/show_bug.cgi?id=2058404
https://github.com/ManageIQ/kubeclient/issues/554
https://github.com/ManageIQ/kubeclient/pull/556
https://github.com/ManageIQ/kubeclient/issues/555
https://github.com/ManageIQ/kubeclient/pull/556

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-0759
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0759

Please adjust the affected versions in the BTS as needed.