Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3343-1 advisory.

    - CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized.
    (bsc#1194400)
    - CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
    - CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1211631)
    - CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets.
    (bsc#1229869)
    - CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
    - CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers.
    (bsc#1229869)
    - CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests.
    (bsc#1219964)
    - CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1222539)
    - CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)

    Bug fixes:

    - Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
    - Fix multiple issues for successful `kubeadm init` run. (bsc#1214406)
    - Update go to version 1.22.5 in build requirements. (bsc#1229858)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3341-1 advisory.

    - CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized.
    (bsc#1194400)
    - CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
    - CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1211631)
    - CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets.
    (bsc#1229869)
    - CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
    - CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers.
    (bsc#1229869)
    - CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests.
    (bsc#1219964)
    - CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1222539)
    - CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)

    Bug fixes:

    - Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
    - Fix multiple issues for successful `kubeadm init` run. (bsc#1214406)
    - Update go to version 1.22.5 in build requirements. (bsc#1229858)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the kubernetes package has been released.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5009 advisory.

  - golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

  - kube-apiserver: Bypassing policies imposed by the ImagePolicyWebhook  admission plugin (CVE-2023-2727)

  - kube-apiserver: Bypassing enforce mountable secrets policy imposed by the  ServiceAccount admission plugin     (CVE-2023-2728)

  - openshift: OCP & FIPS mode (CVE-2023-3089)

  - ovn: service monitor MAC flow is not rate limited (CVE-2023-3153)

  - golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

  - scipy: use-after-free in Py_FindObjects() function (CVE-2023-29824)

  - goproxy: Denial of service (DoS) via unspecified vectors. (CVE-2023-37788)

  - golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)

  - golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

  - golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

  - golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

  - golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)     (CVE-2023-39325)

  - HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)     (CVE-2023-44487)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:5008 advisory.

  - kube-apiserver: PrivEsc (CVE-2023-1260)

  - kube-apiserver: Bypassing policies imposed by the ImagePolicyWebhook  admission plugin (CVE-2023-2727)

  - kube-apiserver: Bypassing enforce mountable secrets policy imposed by the  ServiceAccount admission plugin     (CVE-2023-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:3260-1 advisory.

  - Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers. (CVE-2023-2727)

  - Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service account's secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers. (CVE-2023-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-25545 advisory.

    - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12561 advisory.

    - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.24.15

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12562 advisory.

    - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.24.15

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12563 advisory.

    - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11
    - CVE-2023-27496
    - CVE-2023-27488
    - CVE-2023-27493
    - CVE-2023-27492
    - CVE-2023-27491
    - CVE-2023-27487
    - Update istio to 1.15.3 to address Istio CVE-2022-392787
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.24
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.23
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.22
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.21
    - Resolve Kubernetes CVE-2022-3172 for version 1.21
    - Resolve Kubernetes CVE-2022-3172 for version 1.22
    - Resolve Kubernetes CVE-2022-3172 for version 1.23
    - Upgrade Istio from 1.13.5 to 1.13.7 to resolve the CVE-2022-31045
    - Istio CVE-2022-31045, CVE-2022-29225, CVE-2022-29224,CVE-2022-29226,CVE-2022-29228,CVE-2022-29227
    - Address qemu CVE-2022-26353, CVE-2021-3748

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-25546 advisory.

    - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-12564 advisory.

    - CVE-2023-2727, CVE-2023-2728 Kubernetes upgraded to 1.25.11
    - CVE-2023-27496
    - CVE-2023-27488
    - CVE-2023-27493
    - CVE-2023-27492
    - CVE-2023-27491
    - CVE-2023-27487
    - Update istio to 1.15.3 to address Istio CVE-2022-392787
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.24
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.23
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.22
    - Resolve kubernetes CVE-2022-3294 & CVE-2022-3162 for version 1.21
    - Resolve Kubernetes CVE-2022-3172 for version 1.21
    - Resolve Kubernetes CVE-2022-3172 for version 1.22
    - Resolve Kubernetes CVE-2022-3172 for version 1.23
    - Upgrade Istio from 1.13.5 to 1.13.7 to resolve the CVE-2022-31045
    - Istio CVE-2022-31045, CVE-2022-29225, CVE-2022-29224,CVE-2022-29226,CVE-2022-29228,CVE-2022-29227
    - Address qemu CVE-2022-26353, CVE-2021-3748

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2542-1 advisory.

  - Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers. (CVE-2023-2727)

  - Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service account's secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers. (CVE-2023-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2544-1 advisory.

  - Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers. (CVE-2023-2727)

  - Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service account's secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers. (CVE-2023-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2543-1 advisory.

  - Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers. (CVE-2023-2727)

  - Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service account's secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers. (CVE-2023-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2541-1 advisory.

  - Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using     ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is     used together with ephemeral containers. (CVE-2023-2727)

  - Users may be able to launch containers that bypass the mountable secrets policy enforced by the     ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a     service account may only reference secrets specified in the service account's secrets field. Kubernetes     clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-     mountable-secrets` annotation are used together with ephemeral containers. (CVE-2023-2728)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
207490	SUSE SLES15 Security Update : kubernetes1.24 (SUSE-SU-2024:3343-1)	Nessus	SuSE Local Security Checks	medium
207488	SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2024:3341-1)	Nessus	SuSE Local Security Checks	medium
204440	Photon OS 4.0: Kubernetes PHSA-2023-4.0-0427	Nessus	PhotonOS Local Security Checks	critical
204171	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0043	Nessus	PhotonOS Local Security Checks	critical
203746	Photon OS 3.0: Kubernetes PHSA-2023-3.0-0631	Nessus	PhotonOS Local Security Checks	critical
203647	Photon OS 5.0: Kubernetes PHSA-2023-5.0-0049	Nessus	PhotonOS Local Security Checks	critical
194294	RHEL 8 / 9 : OpenShift Container Platform 4.14.0 (RHSA-2023:5009)	Nessus	Red Hat Local Security Checks	critical
194227	RHEL 9 : Red Hat build of MicroShift 4.14.0 (RHSA-2023:5008)	Nessus	Red Hat Local Security Checks	high
179679	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.24 (SUSE-SU-2023:3260-1)	Nessus	SuSE Local Security Checks	medium
177905	Oracle Linux 7 : olcne (ELSA-2023-25545)	Nessus	Oracle Linux Local Security Checks	medium
177899	Oracle Linux 8 : kubernetes (ELSA-2023-12561)	Nessus	Oracle Linux Local Security Checks	medium
177898	Oracle Linux 7 : kubernetes (ELSA-2023-12562)	Nessus	Oracle Linux Local Security Checks	medium
177897	Oracle Linux 7 : kubernetes (ELSA-2023-12563)	Nessus	Oracle Linux Local Security Checks	medium
177896	Oracle Linux 8 : olcne (ELSA-2023-25546)	Nessus	Oracle Linux Local Security Checks	medium
177895	Oracle Linux 8 : kubernetes (ELSA-2023-12564)	Nessus	Oracle Linux Local Security Checks	medium
177448	SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2023:2542-1)	Nessus	SuSE Local Security Checks	medium
177447	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.24 (SUSE-SU-2023:2544-1)	Nessus	SuSE Local Security Checks	medium
177442	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.23 (SUSE-SU-2023:2543-1)	Nessus	SuSE Local Security Checks	medium
177437	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.18 (SUSE-SU-2023:2541-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2023-2728

medium

Tenable Plugins

medium

medium

critical

critical

critical

critical

critical

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium