Kyverno vulnerable due to usage of insecure cipher

{
  "id": "c8006ba05df88784168124967ffef34922f5f715962d061c6ef7d55162a39278",
  "url": "https://osv.dev/vulnerability/GHSA-hgv6-w7r3-w4qw",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Kyverno vulnerable due to usage of insecure cipher",
    "summary": "### Summary Insecure 3DES ciphers are used which may lead to exploitation of the [Sweet32 vulnerability](https://sweet32.info/). Specifically, the ciphers TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (secp256r1) and TLS_RSA_WITH_3DES_EDE_CBC_SHA (rsa 2048) are allowed. See CVE-2016-2183. This is fixed in Kyverno v1.9.5 and v1.10.0 and no known users have been affected. ### Details The ciphers in affected versions can be read using the following command which uses `nmap`: ```sh $ kubectl exec -it mypod -n kyverno sh kubectl exec [POD] [COMMAND] is DEPRECATED and will be removed in a future version. Use kubectl exec [POD] -- [COMMAND] instead. **nmap -sV --script ssl-enum-ciphers -p 443 kyverno-cleanup-controller** or **nmap -sV --script ssl-enum-ciphers -p 443 kyverno-svc** Starting Nmap 7.92 ( https://nmap.org ) at 2023-05-26 10:55 UTC Nmap scan report for kyverno-cleanup-controller (10.103.199.233) Host is up (0.000058s latency). rDNS record for 10.103.199.233: kyverno-cleanup-controller.kyverno.svc.cluster.local PORT STATE SERVICE VERSION 443/tcp open ssl/http Golang net/http server (Go-IPFS json-rpc or InfluxDB API) | ssl-enum-ciphers: | TLSv1.2: | ciphers: **| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA (secp256r1) - C** | TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (secp256r1) - A | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (secp256",
    "evidence": "osv:GHSA-hgv6-w7r3-w4qw",
    "products": [
      {
        "name": {
          "value": "github.com/kyverno/kyverno",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.5",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GHSA-hgv6-w7r3-w4qw",
      "aliases": [
        "BIT-kyverno-2023-54356",
        "CVE-2023-54356",
        "GHSA-hgv6-w7r3-w4qw",
        "GO-2023-1804"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.9.5"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/kyverno/kyverno",
            "purl": "pkg:golang/github.com/kyverno/kyverno",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/05/GHSA-hgv6-w7r3-w4qw/GHSA-hgv6-w7r3-w4qw.json"
          }
        }
      ],
      "modified": "2026-10-14T11:10:48.978536185Z",
      "provider": "osv",
      "references": [
        "https://github.com/kyverno/kyverno/security/advisories/GHSA-hgv6-w7r3-w4qw",
        "https://github.com/kyverno/kyverno/pull/7308",
        "https://github.com/kyverno/kyverno",
        "https://github.com/kyverno/kyverno/releases/tag/v1.9.5"
      ],
      "provider_metadata": {
        "cwe_ids": [],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": null,
        "github_reviewed_at": "2023-05-30T20:07:06Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-54356",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 316233,
  "published_at": "2023-05-30T20:07:06+00:00"
}

{
  "id": "8f651d308fe8c069e228b980aeda2a11503ed45a72b8a3c3b90569f42a12536a",
  "url": "https://osv.dev/vulnerability/GO-2023-1804",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Kyverno vulnerable due to usage of insecure cipher in github.com/kyverno/kyverno",
    "summary": "Kyverno vulnerable due to usage of insecure cipher in github.com/kyverno/kyverno",
    "evidence": "osv:GO-2023-1804",
    "products": [
      {
        "name": {
          "value": "github.com/kyverno/kyverno",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.5",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2023-1804",
      "aliases": [
        "BIT-kyverno-2023-54356",
        "CVE-2023-54356",
        "GHSA-hgv6-w7r3-w4qw",
        "GO-2023-1804"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.9.5"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/kyverno/kyverno",
            "purl": "pkg:golang/github.com/kyverno/kyverno",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2023-1804.json"
          },
          "ecosystem_specific": {}
        }
      ],
      "modified": "2026-10-14T11:10:48.978536185Z",
      "provider": "osv",
      "references": [
        "https://github.com/kyverno/kyverno/security/advisories/GHSA-hgv6-w7r3-w4qw",
        "https://github.com/kyverno/kyverno/pull/7308",
        "https://github.com/kyverno/kyverno/releases/tag/v1.9.5"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2023-1804",
        "review_status": "UNREVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2023-54356",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 316235,
  "published_at": "2024-08-20T20:31:32+00:00"
}