CVSS: 2.7EPSS: 0%CPEs: 1EXPL: 1CVE-2024-3177 – Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin
https://notcve.org/view.php?id=CVE-2024-3177
A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated. Se descubrió un problema de seguridad en Kubernetes donde los usuarios pueden lanzar contenedores que omiten la política de secretos montables aplicada por el complemento de admisión ServiceAccount cuando usan contenedores, contenedores init y contenedores efímeros con el campo envFrom completo. La política garantiza que los pods que se ejecutan con una cuenta de servicio solo puedan hacer referencia a secretos especificados en el campo de secretos de la cuenta de servicio. • https://github.com/FreySolarEye/Exploit-CVE-2024-31777 http://www.openwall.com/lists/oss-security/2024/04/16/4 https://github.com/kubernetes/kubernetes/issues/124336 https://groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYFHIQ6XRKRYBI2F5UESH67BJBQXUPT https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WL54MTLGMTBZZO5PYGEGEBERTMADC4WC https://access.redhat.com& • CWE-20: Improper Input Validation CWE-213: Exposure of Sensitive Information Due to Incompatible Policies •
CVSS: 8.8EPSS: 0%CPEs: 7EXPL: 0CVE-2023-5528 – Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation
https://notcve.org/view.php?id=CVE-2023-5528
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes. Se descubrió un problema de seguridad en Kubernetes donde un usuario que puede crear pods y volúmenes persistentes en nodos de Windows puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ven afectados si utilizan un complemento de almacenamiento en árbol para nodos de Windows. A flaw was found in Kubernetes, where a user who can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. • https://github.com/kubernetes/kubernetes/issues/121879 https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4 https://security.netapp.com/advisory/ntap-20240119 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2023-3893 – Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalation
https://notcve.org/view.php?id=CVE-2023-3893
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes running kubernetes-csi-proxy may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes running kubernetes-csi-proxy. Se descubrió un problema de seguridad en Kubernetes donde un usuario que puede crear pods en nodos de Windows que ejecutan kubernetes-csi-proxy puede escalar a privilegios de administrador en esos nodos. Los clústeres de Kubernetes solo se ven afectados si incluyen nodos de Windows que ejecutan kubernetes-csi-proxy. • https://github.com/kubernetes/kubernetes/issues/119594 https://groups.google.com/g/kubernetes-security-announce/c/lWksE2BoCyQ https://security.netapp.com/advisory/ntap-20231221-0004 • CWE-20: Improper Input Validation •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-5044 – Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation
https://notcve.org/view.php?id=CVE-2023-5044
Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation. Inyección de código a través de la anotación nginx.ingress.kubernetes.io/permanent-redirect. • https://github.com/r0binak/CVE-2023-5044 https://github.com/KubernetesBachelor/CVE-2023-5044 http://www.openwall.com/lists/oss-security/2023/10/25/3 https://github.com/kubernetes/ingress-nginx/issues/10572 https://groups.google.com/g/kubernetes-security-announce/c/ukuYYvRNel0 https://security.netapp.com/advisory/ntap-20240307-0012 • CWE-20: Improper Input Validation CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-5043 – Ingress nginx annotation injection causes arbitrary command execution
https://notcve.org/view.php?id=CVE-2023-5043
Ingress nginx annotation injection causes arbitrary command execution. La inyección de anotaciones de Ingress nginx provoca la ejecución de comandos arbitrarios. • https://github.com/r0binak/CVE-2023-5043 http://www.openwall.com/lists/oss-security/2023/10/25/4 https://github.com/kubernetes/ingress-nginx/issues/10571 https://groups.google.com/g/kubernetes-security-announce/c/pVsXsOpxYZo https://security.netapp.com/advisory/ntap-20240307-0012 • CWE-20: Improper Input Validation CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •