Detections
Analytics
SCA: security update for github.com/kubeedge/kubeedge (GHSA-vwm6-qc77-v2rh)
high Tenable Self-Hosted Container Security Plugin ID 419582
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- KubeEdge is an open source system for extending native containerized application orchestration
capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2, and 1.9.4, the ServiceBus server on the
edge side may be susceptible to a DoS attack if an HTTP request containing a very large Body is sent to
it. It is possible for the node to be exhausted of memory. The consequence of the exhaustion is that other
services on the node, e.g. other containers, will be unable to allocate memory and thus causing a denial
of service. Malicious apps accidentally pulled by users on the host and have the access to send HTTP
requests to localhost may make an attack. It will be affected only when users enable the `ServiceBus`
module in the config file `edgecore.yaml`. This bug has been fixed in Kubeedge 1.11.1, 1.10.2, and 1.9.4.
As a workaround, disable the `ServiceBus` module in the config file `edgecore.yaml`. (CVE-2022-31073)
See Also
Plugin Details
Severity: High
ID: 419582
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.18
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Temporal Score: 3.4
Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS Score Source: CVE-2022-31073
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 7/11/2022
Vulnerability Publication Date: 7/11/2022
Reference Information
CVE: CVE-2022-31073
cwe: CWE-400