CVE-2023-2728

A flaw was found in Kubernetes, where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures that pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with ephemeral containers.

This update for kubernetes1.23 fixes the following issues. Escape, meta and control sequences in raw data output to terminal not neutralized. Bypass of policies imposed by the ImagePolicyWebhook admission plugin. Bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. Go1.20: excessive resource consumption when dealing with rapid stream resets. Google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. Golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers. Kube-controller-manager pod crash when processing malformed HPA v1 manifests. Bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin. Github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. Bug fixes. Use -trimpath in non-DBG mode for reproducible builds. Fixed multiple issues for successful 'kubeadm init' run. Update go to version 1.22.5 in build requirements.