A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and ephemeral containers with the envFrom field populated.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3343-1 advisory.

    - CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized.
    (bsc#1194400)
    - CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
    - CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1211631)
    - CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets.
    (bsc#1229869)
    - CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
    - CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers.
    (bsc#1229869)
    - CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests.
    (bsc#1219964)
    - CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1222539)
    - CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)

    Bug fixes:

    - Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
    - Fix multiple issues for successful `kubeadm init` run. (bsc#1214406)
    - Update go to version 1.22.5 in build requirements. (bsc#1229858)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3341-1 advisory.

    - CVE-2021-25743: escape, meta and control sequences in raw data output to terminal not neutralized.
    (bsc#1194400)
    - CVE-2023-2727: bypass of policies imposed by the ImagePolicyWebhook admission plugin. (bsc#1211630)
    - CVE-2023-2728: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1211631)
    - CVE-2023-39325: go1.20: excessive resource consumption when dealing with rapid stream resets.
    (bsc#1229869)
    - CVE-2023-44487: google.golang.org/grpc, kube-apiserver: HTTP/2 rapid reset vulnerability. (bsc#1229869)
    - CVE-2023-45288: golang.org/x/net: excessive CPU consumption when processing unlimited sets of headers.
    (bsc#1229869)
    - CVE-2024-0793: kube-controller-manager pod crash when processing malformed HPA v1 manifests.
    (bsc#1219964)
    - CVE-2024-3177: bypass of the mountable secrets policy enforced by the ServiceAccount admission plugin.
    (bsc#1222539)
    - CVE-2024-24786: github.com/golang/protobuf: infinite loop when unmarshaling invalid JSON. (bsc#1229867)

    Bug fixes:

    - Use -trimpath in non-DBG mode for reproducible builds. (bsc#1062303)
    - Fix multiple issues for successful `kubeadm init` run. (bsc#1214406)
    - Update go to version 1.22.5 in build requirements. (bsc#1229858)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the kubernetes package has been released.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0043 advisory.

    Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge     device deployments and is built from the edge capabilities of Red Hat OpenShift Container Platform.
    MicroShift is an application that is deployed on top of Red Hat Enterprise Linux devices at the edge,     providing an efficient way to operate single-node clusters in these low-resource environments.

    This advisory contains the RPM packages for Red Hat build of MicroShift 4.16.0. Read the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:0041

    All Red Hat build of MicroShift 4.16 users are advised to use these updated packages and images when they     are available in the RPM repository.

    Security Fix(es):

    * golang-protobuf: encoding/protojson, internal/encoding/json: infinite     loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON     (CVE-2024-24786)
    * kubernetes: kube-apiserver: bypassing mountable secrets policy imposed by     the ServiceAccount admission plugin (CVE-2024-3177)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:2054 advisory.

    Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution     designed for on-premise or private cloud deployments.

    This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.14.23. See the     following advisory for the container images for this release:

    https://access.redhat.com/errata/RHBA-2024:2051

    Security Fix(es):

    * jose-go: improper handling of highly compressed data (CVE-2024-28180)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images     when they are available in the appropriate release channel. To check for available updates, use the     OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at     https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-ce2eefc399 advisory.

    Update Kubernetes to v1.29.4 for Fedora 40. Resolves CVE-2024-3177: Bypassing mountable secrets policy     imposed by the ServiceAccount admission plugin.

    Additional bug and regression fixes include a bump to Golang.org/x/net to v0.23.0 to address     CVE-2023-45288 .

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-662a8b6005 advisory.

    Updates Fedora 30 to Kubernetes 1.27.13.
    Resolves CVE-2024-3177: Bypassing mountable secrets policy imposed by the ServiceAccount admission plugin.
    In addition, a few bug and regression fixes.

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1403-1 advisory.

  - A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the     mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init     containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running     with a service account may only reference secrets specified in the service account's secrets field.
    Kubernetes clusters are only affected if the ServiceAccount admission plugin and the     kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and     ephemeral containers with the envFrom field populated. (CVE-2024-3177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1404-1 advisory.

  - A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the     mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init     containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running     with a service account may only reference secrets specified in the service account's secrets field.
    Kubernetes clusters are only affected if the ServiceAccount admission plugin and the     kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and     ephemeral containers with the envFrom field populated. (CVE-2024-3177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
207490	SUSE SLES15 Security Update : kubernetes1.24 (SUSE-SU-2024:3343-1)	Nessus	SuSE Local Security Checks	critical
207488	SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2024:3341-1)	Nessus	SuSE Local Security Checks	critical
204158	Photon OS 4.0: Kubernetes PHSA-2024-4.0-0598	Nessus	PhotonOS Local Security Checks	low
204141	Photon OS 5.0: Kubernetes PHSA-2024-5.0-0255	Nessus	PhotonOS Local Security Checks	low
201095	RHEL 9 : Red Hat build of MicroShift 4.16.0 (RHSA-2024:0043)	Nessus	Red Hat Local Security Checks	low
194947	RHEL 8 / 9 : OpenShift Container Platform 4.14.23 (RHSA-2024:2054)	Nessus	Red Hat Local Security Checks	low
194505	Fedora 40 : kubernetes (2024-ce2eefc399)	Nessus	Fedora Local Security Checks	low
193862	Fedora 39 : kubernetes (2024-662a8b6005)	Nessus	Fedora Local Security Checks	low
193807	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.24 (SUSE-SU-2024:1403-1)	Nessus	SuSE Local Security Checks	low
193766	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.23 (SUSE-SU-2024:1404-1)	Nessus	SuSE Local Security Checks	low

Detections

Analytics

CVE-2024-3177

low

Tenable Plugins

critical

critical

low

low

low

low

low

low

low

low