Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3343-1 advisory.

    - CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized.
    (bsc#1194400)
    - CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
    - CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1211631)
    - CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets.
    (bsc#1229869)
    - CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
    - CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers.
    (bsc#1229869)
    - CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests.
    (bsc#1219964)
    - CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1222539)
    - CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)

    Bug fixes:

    - Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
    - Fix multiple issues for successful `kubeadm init` run. (bsc#1214406)
    - Update go to version 1.22.5 in build requirements. (bsc#1229858)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3341-1 advisory.

    - CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized.
    (bsc#1194400)
    - CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
    - CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1211631)
    - CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets.
    (bsc#1229869)
    - CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
    - CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers.
    (bsc#1229869)
    - CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests.
    (bsc#1219964)
    - CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1222539)
    - CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)

    Bug fixes:

    - Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
    - Fix multiple issues for successful `kubeadm init` run. (bsc#1214406)
    - Update go to version 1.22.5 in build requirements. (bsc#1229858)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the kubernetes package has been released.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5009 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.14.0. See the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2023:5006

    Security Fix(es):

    * golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)     (CVE-2023-39325)

    * HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)

    * openshift: OCP & FIPS mode (CVE-2023-3089)

    * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

    * ovn: service monitor MAC flow is not rate limited (CVE-2023-3153)

    * golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

    * scipy: use-after-free in Py_FindObjects() function (CVE-2023-29824)

    * goproxy: Denial of service (DoS) via unspecified vectors. (CVE-2023-37788)

    * golang: html/template:  improper handling of HTML-like comments within script contexts (CVE-2023-39318)

    * golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

    * golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

    * golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5008 advisory.

    Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge     device deployments and is built from the edge capabilities of Red Hat OpenShift. MicroShift is an     application that is deployed on top of Red Hat Enterprise Linux devices at the edge, providing an     efficient way to operate single-node clusters in these low-resource environments.

    This advisory contains the RPM packages for Red Hat build of MicroShift 4.14.0. Read the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2023:5006

    All of the bug fixes may not be documented in this advisory. Read the following release notes     documentation for details about these changes:

    https://access.redhat.com/documentation/en-us/red_hat_build_of_microshift/4.14/html/release_notes/index

    Security Fix(es):

    * kube-apiserver: PrivEsc (CVE-2023-1260)

    * kube-apiserver: Bypassing policies imposed by the ImagePolicyWebhook  admission plugin (CVE-2023-2727)

    * kube-apiserver: Bypassing enforce mountable secrets policy imposed by the  ServiceAccount admission     plugin (CVE-2023-2728)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3260-1 advisory.

  - Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers. (CVE-2023-2727)

  - Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service account's secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers. (CVE-2023-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-25545 advisory.

    - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12561 advisory.

    - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.24.15

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12562 advisory.

    - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.24.15

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12563 advisory.

    - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11
    - CVE-2023-27496
    - CVE-2023-27488
    - CVE-2023-27493
    - CVE-2023-27492
    - CVE-2023-27491
    - CVE-2023-27487
    - Update istio to 1.15.3 to address Istio CVE-2022-392787
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.24
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.23
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.22
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.21
    - Resolve Kubernetes CVE-2022-3172 for version 1.21
    - Resolve Kubernetes CVE-2022-3172 for version 1.22
    - Resolve Kubernetes CVE-2022-3172 for version 1.23
    - Upgrade Istio from 1.13.5 to 1.13.7 to resolve the CVE-2022-31045
    - Istio CVE-2022-31045, CVE-2022-29225, CVE-2022-29224,CVE-2022-29226,CVE-2022-29228,CVE-2022-29227
    - Address qemu CVE-2022-26353, CVE-2021-3748

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-25546 advisory.

    - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12564 advisory.

    - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11
    - CVE-2023-27496
    - CVE-2023-27488
    - CVE-2023-27493
    - CVE-2023-27492
    - CVE-2023-27491
    - CVE-2023-27487
    - Update istio to 1.15.3 to address Istio CVE-2022-392787
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.24
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.23
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.22
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.21
    - Resolve Kubernetes CVE-2022-3172 for version 1.21
    - Resolve Kubernetes CVE-2022-3172 for version 1.22
    - Resolve Kubernetes CVE-2022-3172 for version 1.23
    - Upgrade Istio from 1.13.5 to 1.13.7 to resolve the CVE-2022-31045
    - Istio CVE-2022-31045, CVE-2022-29225, CVE-2022-29224,CVE-2022-29226,CVE-2022-29228,CVE-2022-29227
    - Address qemu CVE-2022-26353, CVE-2021-3748

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2542-1 advisory.

  - Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers. (CVE-2023-2727)

  - Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service account's secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers. (CVE-2023-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2544-1 advisory.

  - Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers. (CVE-2023-2727)

  - Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service account's secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers. (CVE-2023-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2543-1 advisory.

  - Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers. (CVE-2023-2727)

  - Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service account's secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers. (CVE-2023-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2541-1 advisory.

  - Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers. (CVE-2023-2727)

  - Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service account's secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers. (CVE-2023-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
207490	SUSE SLES15 Security Update : kubernetes1.24 (SUSE-SU-2024:3343-1)	Nessus	SuSE Local Security Checks	critical
207488	SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2024:3341-1)	Nessus	SuSE Local Security Checks	critical
204440	Photon OS 4.0: Kubernetes PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	critical
204171	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0043	Nessus	PhotonOS Local Security Checks	critical
203746	Photon OS 3.0: Kubernetes PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	critical
203647	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
194294	RHEL 8 / 9 : OpenShift Container Platform 4.14.0 (RHSA-2023:5009)	Nessus	Red Hat Local Security Checks	critical
194227	RHEL 9 : Red Hat build of MicroShift 4.14.0 (RHSA-2023:5008)	Nessus	Red Hat Local Security Checks	high
179679	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.24 (SUSE-SU-2023:3260-1)	Nessus	SuSE Local Security Checks	medium
177905	Oracle Linux 7 : olcne (ELSA-2023-25545)	Nessus	Oracle Linux Local Security Checks	medium
177899	Oracle Linux 8 : kubernetes (ELSA-2023-12561)	Nessus	Oracle Linux Local Security Checks	medium
177898	Oracle Linux 7 : kubernetes (ELSA-2023-12562)	Nessus	Oracle Linux Local Security Checks	medium
177897	Oracle Linux 7 : kubernetes (ELSA-2023-12563)	Nessus	Oracle Linux Local Security Checks	medium
177896	Oracle Linux 8 : olcne (ELSA-2023-25546)	Nessus	Oracle Linux Local Security Checks	medium
177895	Oracle Linux 8 : kubernetes (ELSA-2023-12564)	Nessus	Oracle Linux Local Security Checks	medium
177448	SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2023:2542-1)	Nessus	SuSE Local Security Checks	medium
177447	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.24 (SUSE-SU-2023:2544-1)	Nessus	SuSE Local Security Checks	medium
177442	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.23 (SUSE-SU-2023:2543-1)	Nessus	SuSE Local Security Checks	medium
177437	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.18 (SUSE-SU-2023:2541-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-2728

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium