8.0
High
CVE-2023-1260 An authentication bypass vulnerability was discovered in kube-apiserver
Description
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat OpenShift Container Platform 4.10 | Versions not published | |
| Red Hat OpenShift Container Platform 4.11 | Versions not published | |
| Red Hat OpenShift Container Platform 4.12 | Versions not published | |
| Red Hat OpenShift Container Platform 4.13 | Versions not published | |
| Red Hat OpenShift Container Platform 4.14 | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published |
References
- RHSA-2023:3976 access.redhat.com
- RHSA-2023:4093 access.redhat.com
- RHSA-2023:4312 access.redhat.com
- RHSA-2023:4898 access.redhat.com
- RHSA-2023:5008 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2176267 bugzilla.redhat.com
- github.com github.com
- security.netapp.com security.netapp.com
Timeline
- Published
- Last modified