CVE-2022-3172: 
Jenkins vulnerability analysis and mitigation

A medium severity vulnerability (CVE-2022-3172) with a CVSS score of 5.1 was discovered in the Kubernetes API server on September 16, 2022. The vulnerability allows an aggregated API server to redirect client traffic to any URL, potentially leading to credential theft and information leakage (Palo Alto Blog, CVE Mitre).

The vulnerability exists in the Kubernetes aggregation layer, which runs with the kube-apiserver. The security issue arises because the Kubernetes API server does not validate responses from the aggregated API server. When a compromised aggregated API server returns a redirect response pointing to a malicious endpoint, this response is forwarded to the client, causing unintended actions. The vulnerability affects kube-apiserver versions through v1.21.14, v1.22.0-v1.22.13, v1.23.0-v1.23.10, v1.24.0-v1.24.4, and v1.25.0 (GitHub Issue, Palo Alto Blog).

The exploitation of this vulnerability could lead to clients performing unexpected and unintended actions, as well as forwarding the client's API server credentials to third parties. This creates potential risks for credential theft and information leakage (CVE Mitre, Palo Alto Blog).

The vulnerability has been fixed in kube-apiserver versions v1.25.1, v1.24.5, v1.23.11, and v1.22.14. The fix blocks all HTTP 3xx responses that contain the HTTP Location header from aggregated API servers by default. If redirect functionality is required and aggregated API servers are trusted, administrators can set the --aggregator-reject-forwarding-redirect flag to false. No direct mitigation is available aside from upgrading (Palo Alto Blog, GitHub Issue).

The vulnerability was reported by Nicolas Joly & Weinong Wang from Microsoft and was fixed and coordinated by the Kubernetes security team including Di Jin, enj, liggitt, lavalamp, deads2k, and puerco (GitHub Issue).