diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index b62a56ecdc..23b9114dc8 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -30,6 +30,12 @@ All notable changes to the **Prowler SDK** are documented in this file. ### Fixed - Add github provider to `usage` section of `prowler -h`: [(#7906)](https://github.com/prowler-cloud/prowler/pull/7906) +--- +## [v5.7.5] (Prowler v5.7.5) + +### Fixed +- Fix `apiserver_strong_ciphers_only` check for K8S provider. [(#7952)](https://github.com/prowler-cloud/prowler/pull/7952) + --- ## [v5.7.3] (Prowler v5.7.3) diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.py b/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.py index afe2420ce2..781e895324 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.py @@ -23,16 +23,14 @@ class apiserver_strong_ciphers_only(Check): # Check if strong ciphers are set in "--tls-cipher-suites" for command in container.command: if command.startswith("--tls-cipher-suites"): - if ( - command.split("=")[1] - .split(",") - .issubset( - apiserver_client.audit_config.get( - "apiserver_strong_ciphers", - default_apiserver_strong_ciphers, - ) + configured_ciphers = set(command.split("=")[1].split(",")) + allowed_ciphers = set( + apiserver_client.audit_config.get( + "apiserver_strong_ciphers", + default_apiserver_strong_ciphers, ) - ): + ) + if configured_ciphers.issubset(allowed_ciphers): strong_ciphers_set = True if not strong_ciphers_set: break