CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-2728 – Bypassing enforce mountable secrets policy imposed by the ServiceAccount admission plugin
https://notcve.org/view.php?id=CVE-2023-2728
Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers. A flaw was found in Kubernetes, where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures that pods running with a service account may only reference secrets specified in the service account’s secrets field. • http://www.openwall.com/lists/oss-security/2023/07/06/3 https://github.com/kubernetes/kubernetes/issues/118640 https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8 https://security.netapp.com/advisory/ntap-20230803-0004 https://access.redhat.com/security/cve/CVE-2023-2728 https://bugzilla.redhat.com/show_bug.cgi?id=2211348 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-2727 – Bypassing policies imposed by the ImagePolicyWebhook admission plugin
https://notcve.org/view.php?id=CVE-2023-2727
Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. A flaw was found in Kubernetes, where users may be able to launch containers using images restricted by the ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. • http://www.openwall.com/lists/oss-security/2023/07/06/2 https://github.com/kubernetes/kubernetes/issues/118640 https://groups.google.com/g/kubernetes-security-announce/c/vPWYJ_L84m8 https://security.netapp.com/advisory/ntap-20230803-0004 https://access.redhat.com/security/cve/CVE-2023-2727 https://bugzilla.redhat.com/show_bug.cgi?id=2211322 • CWE-20: Improper Input Validation •
CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-2431 – Bypass of seccomp profile enforcement
https://notcve.org/view.php?id=CVE-2023-2431
A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet. A flaw was found in Kubernetes. • https://github.com/kubernetes/kubernetes/issues/118690 https://groups.google.com/g/kubernetes-security-announce/c/QHmx0HOQa10 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/43HDSKBKPSW53OW647B5ETHRWFFNHSRQ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBX4RL4UOC7JHWWYB2AJCKSUM7EG5Y5G https://access.redhat.com/security/cve/CVE-2023-2431 https://bugzilla.redhat.com/show_bug.cgi?id=2215555 • CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-3294 – Node address isn't always verified when proxying
https://notcve.org/view.php?id=CVE-2022-3294
Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network. • https://github.com/kubernetes/kubernetes/issues/113757 https://groups.google.com/g/kubernetes-security-announce/c/VyPOxF7CIbA https://security.netapp.com/advisory/ntap-20230505-0007 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2021-25749 – runAsNonRoot logic bypass for Windows containers
https://notcve.org/view.php?id=CVE-2021-25749
Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option to true. A flaw was found in Kubernetes. This issue allows Windows workloads to run as a ContainerAdministrator even when the workloads set the runAsNonRoot option to true. • https://groups.google.com/g/kubernetes-security-announce/c/qqTZgulISzA https://access.redhat.com/security/cve/CVE-2021-25749 https://bugzilla.redhat.com/show_bug.cgi?id=2127808 • CWE-284: Improper Access Control CWE-842: Placement of User into Incorrect Group •