From 0b9ec5436c3558bf1ab39867c7d00e93d6a4cf81 Mon Sep 17 00:00:00 2001 From: Michael Grosser Date: Wed, 23 Mar 2022 08:14:34 -0700 Subject: [PATCH] spell out vuln more --- README.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 8e88aca0..43555d38 100644 --- a/README.md +++ b/README.md @@ -10,10 +10,10 @@ The client supports GET, POST, PUT, DELETE on all the entities available in kube The client currently supports Kubernetes REST api version v1. To learn more about groups and versions in kubernetes refer to [k8s docs](https://kubernetes.io/docs/api/) -## VULNERABILITY❗ +## VULNERABILITY in <= v4.9.2❗ -If you use `Kubeclient::Config`, all gem versions released before 2022 could return incorrect `ssl_options[:verify_ssl]`, -endangering your connection and cluster credentials. +If you use `Kubeclient::Config`, all gem versions <= v4.9.3 can return incorrect `ssl_options[:verify_ssl]`, +allowing MITM attacks on your connection and thereby stealing your cluster credentials. See https://github.com/ManageIQ/kubeclient/issues/554 for details and which versions got a fix. ## Installation