8.0
Élevée
CVE-2023-1260 An authentication bypass vulnerability was discovered in kube-apiserver
Description
An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat OpenShift Container Platform 4.10 | Versions non publiées | |
| Red Hat OpenShift Container Platform 4.11 | Versions non publiées | |
| Red Hat OpenShift Container Platform 4.12 | Versions non publiées | |
| Red Hat OpenShift Container Platform 4.13 | Versions non publiées | |
| Red Hat OpenShift Container Platform 4.14 | Versions non publiées | |
| Red Hat OpenShift Container Platform 4 | Versions non publiées |
Références
- RHSA-2023:3976 access.redhat.com
- RHSA-2023:4093 access.redhat.com
- RHSA-2023:4312 access.redhat.com
- RHSA-2023:4898 access.redhat.com
- RHSA-2023:5008 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2176267 bugzilla.redhat.com
- github.com github.com
- security.netapp.com security.netapp.com
Chronologie
- Publiée
- Dernière modification