x/vulndb: potential Go vuln in github.com/kyverno/kyverno: GHSA-459x-q9hg-4gpq

[GoVulnBot]

Advisory GHSA-459x-q9hg-4gpq references a vulnerability in the following Go modules:

Module
github.com/kyverno/kyverno

Description:

Summary

An attacker with the ability to create Kyverno policies in a Kubernetes cluster can use Service Call functionality to perform SSRF to a server under their control in order to exfiltrate data.

Details

According to the documentation, Service Call is intended to address services located inside the Kubernetes cluster, but this method can also resolve external addresses, which allows making requests outside the Kubernetes cluster.

https://kyverno.io/docs/writing-policies/external-data-sources/#variables-from-service-calls

PoC

Create a slightly modified Cluster Policy from the...

References:

• ADVISORY: GHSA-459x-q9hg-4gpq
• ADVISORY: GHSA-459x-q9hg-4gpq

Cross references:

• github.com/kyverno/kyverno appears in 11 other report(s):
  • data/reports/GO-2022-1180.yaml (x/vulndb: potential Go vuln in github.com/kyverno/kyverno: GHSA-m3cq-xcx9-3gvm #1180)
  • data/reports/GO-2023-1801.yaml (x/vulndb: potential Go vuln in github.com/kyverno/kyverno: CVE-2023-33191 #1801)
  • data/reports/GO-2023-1804.yaml (x/vulndb: potential Go vuln in github.com/kyverno/kyverno: GHSA-hgv6-w7r3-w4qw #1804)
  • data/reports/GO-2023-1819.yaml (x/vulndb: potential Go vuln in github.com/kyverno/kyverno: CVE-2023-34091 #1819)
  • data/reports/GO-2023-2335.yaml (x/vulndb: potential Go vuln in github.com/kyverno/kyverno: CVE-2023-42813 #2335)
  • data/reports/GO-2023-2336.yaml (x/vulndb: potential Go vuln in github.com/kyverno/kyverno: CVE-2023-42814 #2336)
  • data/reports/GO-2023-2337.yaml (x/vulndb: potential Go vuln in github.com/kyverno/kyverno: CVE-2023-42815 #2337)
  • data/reports/GO-2023-2338.yaml (x/vulndb: potential Go vuln in github.com/kyverno/kyverno: CVE-2023-42816 #2338)
  • data/reports/GO-2023-2340.yaml (x/vulndb: potential Go vuln in github.com/kyverno/kyverno: CVE-2023-47630 #2340)
  • data/reports/GO-2024-3230.yaml (x/vulndb: potential Go vuln in github.com/kyverno/kyverno: GHSA-qjvc-p88j-j9rm #3230)
  • data/reports/GO-2025-3562.yaml (x/vulndb: potential Go vuln in github.com/kyverno/kyverno: GHSA-46mp-8w32-6g94 #3562)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/kyverno/kyverno
      vulnerable_at: 1.13.4
summary: Kyverno vulnerable to SSRF via Service Calls in github.com/kyverno/kyverno
ghsas:
    - GHSA-459x-q9hg-4gpq
references:
    - advisory: https://github.com/advisories/GHSA-459x-q9hg-4gpq
    - advisory: https://github.com/kyverno/kyverno/security/advisories/GHSA-459x-q9hg-4gpq
source:
    id: GHSA-459x-q9hg-4gpq
    created: 2025-04-15T22:01:28.294696373Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/665975 mentions this issue: data/reports: add 12 reports