High
ruby-kubeclient — security advisory
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
- Products
- ruby-kubeclient
- Affected versions
- 2.3.0-2, 3.0.0-1, 4.11.0-2, 4.12.0-1, 4.13.0-1, 4.13.0-4, 4.3.0-1, 4.5.0-1, 4.6.0-1, 4.9.1-2, 4.9.2-1, 4.9.2-2
- Fixed versions
- Not specified
- CVEs
- CVE-2022-0759
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 00:39 UTC · Revision 1
Source evidence
A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
osv:UBUNTU-CVE-2022-0759
ruby-kubeclient
Fixed versions: Not specified
ruby-kubeclient
Fixed versions: Not specified
ruby-kubeclient
Fixed versions: Not specified
ruby-kubeclient
Fixed versions: Not specified
ruby-kubeclient
Fixed versions: Not specified
ruby-kubeclient
Fixed versions: Not specified
ruby-kubeclient
Fixed versions: Not specified
Complete source record
{
"id": "3c7c70a9c34c4e4a7dfc1173cd413a3171d10d7c9adbf0ce9969c8fb531ba3c9",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2022-0759",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2022-0759",
"summary": "A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).",
"evidence": "osv:UBUNTU-CVE-2022-0759",
"products": [
{
"name": {
"value": "ruby-kubeclient",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.3.0-2",
"evidence": "/affected/0/versions"
},
{
"value": "3.0.0-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "ruby-kubeclient",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.3.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.5.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "4.6.0-1",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "ruby-kubeclient",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.9.1-2",
"evidence": "/affected/2/versions"
},
{
"value": "4.9.2-1",
"evidence": "/affected/2/versions"
},
{
"value": "4.9.2-2",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "ruby-kubeclient",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.11.0-2",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "ruby-kubeclient",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.12.0-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "ruby-kubeclient",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.13.0-1",
"evidence": "/affected/5/versions"
},
{
"value": "4.13.0-4",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "ruby-kubeclient",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.12.0-1",
"evidence": "/affected/6/versions"
},
{
"value": "4.13.0-1",
"evidence": "/affected/6/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "UBUNTU-CVE-2022-0759",
"aliases": [
"UBUNTU-CVE-2022-0759"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-kubeclient",
"purl": "pkg:deb/ubuntu/ruby-kubeclient?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"2.3.0-2",
"3.0.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-0759.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-kubeclient",
"binary_version": "3.0.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-kubeclient",
"purl": "pkg:deb/ubuntu/ruby-kubeclient?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"4.3.0-1",
"4.5.0-1",
"4.6.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-0759.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-kubeclient",
"binary_version": "4.6.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-kubeclient",
"purl": "pkg:deb/ubuntu/ruby-kubeclient?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"4.9.1-2",
"4.9.2-1",
"4.9.2-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-0759.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-kubeclient",
"binary_version": "4.9.2-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-kubeclient",
"purl": "pkg:deb/ubuntu/ruby-kubeclient?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"4.11.0-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-0759.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-kubeclient",
"binary_version": "4.11.0-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-kubeclient",
"purl": "pkg:deb/ubuntu/ruby-kubeclient?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"4.12.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-0759.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-kubeclient",
"binary_version": "4.12.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-kubeclient",
"purl": "pkg:deb/ubuntu/ruby-kubeclient?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"4.13.0-1",
"4.13.0-4"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-0759.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-kubeclient",
"binary_version": "4.13.0-4"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "ruby-kubeclient",
"purl": "pkg:deb/ubuntu/ruby-kubeclient?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"4.12.0-1",
"4.13.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2022/UBUNTU-CVE-2022-0759.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ruby-kubeclient",
"binary_version": "4.13.0-1"
}
]
}
}
],
"modified": "2026-10-17T12:55:55.854597596Z",
"provider": "osv",
"upstream": [
"CVE-2022-0759"
],
"references": [
"https://ubuntu.com/security/CVE-2022-0759",
"https://bugzilla.redhat.com/show_bug.cgi?id=2058404",
"https://github.com/ManageIQ/kubeclient/issues/554",
"https://github.com/ManageIQ/kubeclient/pull/556",
"https://github.com/ManageIQ/kubeclient/issues/555",
"https://www.cve.org/CVERecord?id=CVE-2022-0759"
]
},
"related_cves": [
{
"value": "CVE-2022-0759",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 354308,
"published_at": "2022-03-25T19:15:00+00:00"
}