GHSA-hgv6-w7r3-w4qw: 
vulnerability analysis and mitigation

A moderate severity vulnerability was identified in Kyverno versions prior to 1.9.5, where insecure 3DES ciphers were being used that could potentially lead to exploitation of the Sweet32 vulnerability. The issue specifically involved the ciphers TLSECDHERSAWITH3DESEDECBCSHA (secp256r1) and TLSRSAWITH3DESEDECBC_SHA (rsa 2048). The vulnerability was discovered and disclosed in May 2023, affecting the Kyverno security policy engine (GitHub Advisory).

The vulnerability stems from the use of weak 64-bit block cipher 3DES, which is vulnerable to the SWEET32 attack (related to CVE-2016-2183). The issue was identified through cipher enumeration using nmap scans on the Kyverno service endpoints, which revealed the presence of these insecure cipher suites in TLSv1.2 configurations. The vulnerability received a moderate severity rating and was tracked as GHSA-hgv6-w7r3-w4qw (GitHub Advisory).

The use of these insecure cipher suites could potentially expose the system to SWEET32 attacks, though no known users were affected by this vulnerability. The impact was primarily related to the theoretical possibility of exploiting these weak ciphers in TLS communications (GitHub Advisory).

The vulnerability was fixed in Kyverno versions 1.9.5 and 1.10.0 by removing the insecure 3DES cipher suites from the TLS configuration. Users are advised to upgrade to these patched versions to mitigate the risk (Kyverno Release, GitHub PR).