External risk intelligence

Kyverno Weak TLS Cipher Suite Vulnerability Affects Long-Lived Connections

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2023-54356

Kyverno is a Kubernetes admission controller that typically operates within a cluster's internal network to manage resource policies. While it exposes TLS endpoints for communication, these are generally intended for internal API server interaction rather than public internet exposure, though some specific deployment architectures may expose these interfaces externally.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a security vulnerability in Kyverno, a tool used for managing Kubernetes policies, where older versions utilized weak encryption methods that could potentially expose small amounts of data over long, high-traffic connections. The issue has been addressed in updated versions.

Weak encryption could expose small data amounts.
Confirms essential security controls for cloud platforms.
Assess relevance and review Kyverno usage.

Attack Path

How an attacker could exploit the issue

An attacker could target Kyverno's TLS endpoints, which are typically exposed to the network, by initiating a long-lived connection with substantial data transfer. This prolonged interaction with vulnerable 3DES cipher suites could eventually allow the attacker to decrypt small portions of the transmitted data.

Network access to TLS endpoints required.
Long-lived connections with large data volumes.
Potential for small amounts of plaintext recovery.

Live Threat

Current exploitation, exposure, and threat context

Kyverno's TLS endpoints, when configured with specific older cipher suites, could be vulnerable to the Sweet32 attack. This attack may allow an attacker to recover small amounts of plaintext data over long-lived TLS connections carrying substantial traffic.

System data on TLS endpoints.
Attacker intercepts large, long-lived TLS traffic.
Limited plaintext data recovery.

Operational Fix

Recommended remediation, mitigation, and detection steps

Kyverno's TLS endpoints are likely managed by platform or infrastructure teams, given its role as a Kubernetes admission controller. The first practical step is to identify all Kyverno instances, confirm their reachability and criticality, and locate the accountable owner. Subsequent remediation planning should be risk-based, considering potential business impact.

Platform/infrastructure teams own the issue.
Verify TLS endpoint reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Kyverno and why does it have TLS endpoints?

Kyverno is a policy management tool for Kubernetes. It functions as an admission controller, which means it intercepts requests to the Kubernetes API server to validate or modify resources. It uses TLS endpoints to secure communication between itself and the API server, ensuring that the policy decisions and configuration data exchanged within the cluster remain encrypted and private.

What is the vulnerability in CVE-2023-54356?

This vulnerability, categorized as CWE-326 (Inadequate Encryption Strength), involves the use of weak 3DES cipher suites within Kyverno's TLS configuration. These older ciphers are susceptible to a technique known as the Sweet32 attack. This class of weakness means that the encryption method is mathematically aging and can be compromised by modern techniques if specific conditions are met, potentially allowing unauthorized access to information.

How does an attacker trigger this vulnerability?

An attacker needs the ability to establish and maintain a long-lived TLS connection with a vulnerable Kyverno endpoint that handles a very large volume of data. The weakness does not manifest in short-lived or low-traffic connections, as the attack requires the massive data exchange necessary to perform the statistical analysis required to recover even small amounts of plaintext.

Do I need to worry if my Kyverno instance is internal?

Halo Surface Signal notes that Kyverno typically operates within a cluster's internal network to manage API server traffic, which often limits exposure. However, you should still evaluate if your specific architecture exposes these TLS endpoints to untrusted segments or the public internet. If your Kyverno endpoints are only accessible from within your secure cluster environment, the risk of an external attacker establishing the required long-lived connection is significantly reduced.

How do I respond to this Kyverno advisory?

The most effective way to address this is to identify your current Kyverno version and upgrade to version 1.9.5, 1.10.0, or later. Since Kyverno is infrastructure-level software, coordinate with your platform or cluster administration team to verify which instances are running vulnerable code. Prioritize these updates based on how critical the Kyverno instances are to your environment and whether they are exposed to broader network segments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.