Aws Privateca Issuer
Monthly
Incorrect authorization in the issuer resolution logic of AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 allows an authenticated remote user to obtain certificates - including subordinate CA certificates - signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize. Affected are clusters running the connector releases up to and including 1.10.0 (Helm chart <= 1.10.0) or the AWS Private CA Connector for Kubernetes EKS add-on before v1.10.1-eksbuild.1; per the CVSS 4.0 vector (PR:L, no user interaction) the attacker must already hold authenticated cluster credentials with namespace-scoped certificate-approval rights, and a cluster-scoped issuer must exist to be targeted. Vendor patches are available in v1.10.1 / v1.10.1-eksbuild.1, no public exploit code has been identified at time of analysis, and the flaw is rated for remediation this week by current prioritization signals.
Incorrect authorization in the issuer resolution logic of AWS Private CA Connector for Kubernetes (aws-privateca-issuer) before v1.10.1 allows an authenticated remote user to obtain certificates - including subordinate CA certificates - signed by a cluster-scoped AWS Private CA issuer that their approval policy does not authorize. Affected are clusters running the connector releases up to and including 1.10.0 (Helm chart <= 1.10.0) or the AWS Private CA Connector for Kubernetes EKS add-on before v1.10.1-eksbuild.1; per the CVSS 4.0 vector (PR:L, no user interaction) the attacker must already hold authenticated cluster credentials with namespace-scoped certificate-approval rights, and a cluster-scoped issuer must exist to be targeted. Vendor patches are available in v1.10.1 / v1.10.1-eksbuild.1, no public exploit code has been identified at time of analysis, and the flaw is rated for remediation this week by current prioritization signals.