From 1241a490f9074e0b1b1f0545f16eacf46ed8daf7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pedro=20Mart=C3=ADn?= Date: Thu, 12 Jun 2025 11:02:48 +0200 Subject: [PATCH] fix(kubernetes): change object type to set for apiserver check (#7952) --- prowler/CHANGELOG.md | 6 ++++++ .../apiserver_strong_ciphers_only.py | 16 +++++++--------- 2 files changed, 13 insertions(+), 9 deletions(-) diff --git a/prowler/CHANGELOG.md b/prowler/CHANGELOG.md index b62a56ecdc..23b9114dc8 100644 --- a/prowler/CHANGELOG.md +++ b/prowler/CHANGELOG.md @@ -30,6 +30,12 @@ All notable changes to the **Prowler SDK** are documented in this file. ### Fixed - Add github provider to `usage` section of `prowler -h`: [(#7906)](https://github.com/prowler-cloud/prowler/pull/7906) +--- +## [v5.7.5] (Prowler v5.7.5) + +### Fixed +- Fix `apiserver_strong_ciphers_only` check for K8S provider. [(#7952)](https://github.com/prowler-cloud/prowler/pull/7952) + --- ## [v5.7.3] (Prowler v5.7.3) diff --git a/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.py b/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.py index afe2420ce2..781e895324 100644 --- a/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.py +++ b/prowler/providers/kubernetes/services/apiserver/apiserver_strong_ciphers_only/apiserver_strong_ciphers_only.py @@ -23,16 +23,14 @@ class apiserver_strong_ciphers_only(Check): # Check if strong ciphers are set in "--tls-cipher-suites" for command in container.command: if command.startswith("--tls-cipher-suites"): - if ( - command.split("=")[1] - .split(",") - .issubset( - apiserver_client.audit_config.get( - "apiserver_strong_ciphers", - default_apiserver_strong_ciphers, - ) + configured_ciphers = set(command.split("=")[1].split(",")) + allowed_ciphers = set( + apiserver_client.audit_config.get( + "apiserver_strong_ciphers", + default_apiserver_strong_ciphers, ) - ): + ) + if configured_ciphers.issubset(allowed_ciphers): strong_ciphers_set = True if not strong_ciphers_set: break