DEBIAN-CVE-2022-0759
Record from OSV · Published March 25, 2022
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| ruby-kubeclient | Debian:13 | 4.9.3-1 |
| ruby-kubeclient | Debian:14 | 4.9.3-1 |
| ruby-kubeclient | Debian:12 | 4.9.3-1 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | ruby-kubeclient | 0 |
| Debian:14 | ruby-kubeclient | 0 |
| Debian:12 | ruby-kubeclient | 0 |
Timeline
- Mar 25, 2022 CVE Published
- Oct 15, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2022-0759
vulnetix vdb fixes DEBIAN-CVE-2022-0759Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2022-0759/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart