CVSS: 5.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-2431 – Bypass of seccomp profile enforcement
https://notcve.org/view.php?id=CVE-2023-2431
A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet. A flaw was found in Kubernetes. • https://github.com/kubernetes/kubernetes/issues/118690 https://groups.google.com/g/kubernetes-security-announce/c/QHmx0HOQa10 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/43HDSKBKPSW53OW647B5ETHRWFFNHSRQ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XBX4RL4UOC7JHWWYB2AJCKSUM7EG5Y5G https://access.redhat.com/security/cve/CVE-2023-2431 https://bugzilla.redhat.com/show_bug.cgi?id=2215555 • CWE-1287: Improper Validation of Specified Type of Input •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-30513
https://notcve.org/view.php?id=CVE-2023-30513
Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log when push mode for durable task logging is enabled. • http://www.openwall.com/lists/oss-security/2023/04/13/3 https://www.jenkins.io/security/advisory/2023-04-12/#SECURITY-3075 • CWE-319: Cleartext Transmission of Sensitive Information •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-3294 – Node address isn't always verified when proxying
https://notcve.org/view.php?id=CVE-2022-3294
Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network. • https://github.com/kubernetes/kubernetes/issues/113757 https://groups.google.com/g/kubernetes-security-announce/c/VyPOxF7CIbA https://security.netapp.com/advisory/ntap-20230505-0007 • CWE-20: Improper Input Validation •
CVSS: 6.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-3162 – Unauthorized read of Custom Resources
https://notcve.org/view.php?id=CVE-2022-3162
Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group. • https://github.com/kubernetes/kubernetes/issues/113756 https://groups.google.com/g/kubernetes-security-announce/c/iUd550j7kjA https://security.netapp.com/advisory/ntap-20230511-0004 https://access.redhat.com/security/cve/CVE-2022-3162 https://bugzilla.redhat.com/show_bug.cgi?id=2136673 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-23: Relative Path Traversal •
CVSS: 3.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-8562 – Bypass of Kubernetes API Server proxy TOCTOU
https://notcve.org/view.php?id=CVE-2020-8562
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. Como mitigación a un informe de 2019 y CVE-2020-8555, Kubernetes intenta impedir que las conexiones proxy accedan a las redes link-local o localhost cuando son realizadas conexiones impulsadas por el usuario a los servicios, pods, nodos o proveedores de servicios StorageClass. • https://github.com/kubernetes/kubernetes/issues/101493 https://groups.google.com/g/kubernetes-security-announce/c/-MFX60_wdOY https://security.netapp.com/advisory/ntap-20220225-0002 • CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition •