Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Severity mismatch for KHV002 vulnerability #532

Open
jreisinger opened this issue Jan 5, 2023 · 1 comment
Open

Severity mismatch for KHV002 vulnerability #532

jreisinger opened this issue Jan 5, 2023 · 1 comment
Labels
bug Something isn't working

Comments

@jreisinger
Copy link

What happened

I scanned a remote CLUSTER and got an output, where .vulnerabilities[0].severity (high) does not match severity at .vulnerabilities[0].avd_reference (low).

$ kube-hunter --remote CLUSTER --log warn --report json | jq
{
  <...SNIP...>
  "vulnerabilities": [
    {
      <...SNIP...>
      "vid": "KHV002",
      "severity": "high",
      "avd_reference": "https://avd.aquasec.com/kube-hunter/khv002/",
      <...SNIP...>
    }
  ]
}

Expected behavior

I would expect vulnerability severity in kube-hunter output to match the severity at https://avd.aquasec.com.
@jreisinger jreisinger added the bug Something isn't working label Jan 5, 2023
@choww
Copy link

choww commented Aug 2, 2023

Also noticed the same thing with some other KHVs:

https://avd.aquasec.com/kube-hunter/khv043
https://avd.aquasec.com/kube-hunter/khv052

The links above listed these as high severity
But output in the CLI for both vulnerabilities are low(for KHV043) and medium (for KHV052)

@KiranBodipi KiranBodipi mentioned this issue Mar 12, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@jreisinger @choww