CVE-2022-41939
Medium
Description
knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised third-party buildpack could expose their registry credentials or local docker socket to a malicious `lifecycle` container. This issues has been patched in PR #1442, and is part of release 1.8.1. This issue only affects users who are using function buildpacks from third-parties; pinning the builder image to a specific content-hash with a valid `lifecycle` image will also mitigate the attack.
SeverityMedium
CVSS6.1
Exploit probability—
ProductLinuxfoundation Knative Func
PublishedNov 19, 2022
First seenNov 19, 2022
Weakness typeCWE-200Sensitive information exposure
How to fix
Update
- linuxfoundation knative_func1.8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linuxfoundation knative_func | v < 1.8.1 | 1.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.