Insecure 3DES Cipher Suite Support in Kyverno

Executive Summary

Kyverno versions 1.9.4 and earlier use insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints. These 64-bit block ciphers are vulnerable to the Sweet32 attack, which could allow an attacker to recover small amounts of plaintext over very long-lived TLS connections with large traffic volumes.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, run an nmap scan on the Kyverno cleanup controller or service to check for the presence of insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA).

Example command: nmap --script ssl-enum-ciphers -p <port> <target-ip>

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this vulnerability to recover small amounts of plaintext from encrypted traffic if the connection is long-lived and carries large volumes of data. This could lead to partial exposure of sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate compliance requirements for strong encryption in GDPR and HIPAA, as it involves the use of weak cipher suites. Organizations using affected Kyverno versions could face compliance risks due to inadequate encryption strength.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Kyverno to version 1.9.5 or later to resolve the issue. Disable the insecure 3DES cipher suites in your TLS configuration if upgrading is not immediately possible.

Useful 0 Not Useful 0