An update of the kubernetes package has been released.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-10036 advisory.

  - Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only     affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports     node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish     connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying     address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this     validation could allow authenticated requests destined for Nodes to to the API server's private network.
    (CVE-2022-3294)

  - Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom     resources of a different type in the same API group without authorization. Clusters are impacted by this     vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same     API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The     same users are not authorized to read another custom resource in the same API group. (CVE-2022-3162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-10034 advisory.

  - Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only     affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports     node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish     connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying     address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this     validation could allow authenticated requests destined for Nodes to to the API server's private network.
    (CVE-2022-3294)

  - Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom     resources of a different type in the same API group without authorization. Clusters are impacted by this     vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same     API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The     same users are not authorized to read another custom resource in the same API group. (CVE-2022-3162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 35 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-2004702d98 advisory.

  - Resolves, in part, #2142161. Security patches that resolve CVE-2022-3162 and CVE-2022-3294.
    (CVE-2022-3162, CVE-2022-3294)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:2292-1 advisory.

  - Windows workloads can run as ContainerAdministrator even when those workloads set the runAsNonRoot option     to true. (CVE-2021-25749)

  - Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom     resources of a different type in the same API group without authorization. Clusters are impacted by this     vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same     API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The     same users are not authorized to read another custom resource in the same API group. (CVE-2022-3162)

  - Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only     affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports     node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish     connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying     address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this     validation could allow authenticated requests destined for Nodes to to the API server's private network.
    (CVE-2022-3294)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-10033 advisory.

  - Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only     affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports     node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish     connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying     address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this     validation could allow authenticated requests destined for Nodes to to the API server's private network.
    (CVE-2022-3294)

  - Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom     resources of a different type in the same API group without authorization. Clusters are impacted by this     vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same     API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The     same users are not authorized to read another custom resource in the same API group. (CVE-2022-3162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-10035 advisory.

  - Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only     affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports     node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish     connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying     address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this     validation could allow authenticated requests destined for Nodes to to the API server's private network.
    (CVE-2022-3294)

  - Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom     resources of a different type in the same API group without authorization. Clusters are impacted by this     vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same     API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The     same users are not authorized to read another custom resource in the same API group. (CVE-2022-3162)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
204025	Photon OS 3.0: Kubernetes PHSA-2023-3.0-0559	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	high
168283	Oracle Linux 8 : kubernetes (ELSA-2022-10036)	Nessus	Oracle Linux Local Security Checks	11/29/2022	3/21/2023	high
168277	Oracle Linux 8 : kubernetes (ELSA-2022-10034)	Nessus	Oracle Linux Local Security Checks	11/29/2022	3/21/2023	high
169038	Fedora 35 : kubernetes (2022-2004702d98)	Nessus	Fedora Local Security Checks	12/22/2022	3/9/2023	high
176412	SUSE SLES15 Security Update : kubernetes1.23 (SUSE-SU-2023:2292-1)	Nessus	SuSE Local Security Checks	5/26/2023	7/14/2023	high
168276	Oracle Linux 7 : kubernetes (ELSA-2022-10033)	Nessus	Oracle Linux Local Security Checks	11/29/2022	3/21/2023	high
168278	Oracle Linux 7 : kubernetes (ELSA-2022-10035)	Nessus	Oracle Linux Local Security Checks	11/29/2022	3/21/2023	high
203298	Photon OS 4.0: Kubernetes PHSA-2023-4.0-0364	Nessus	PhotonOS Local Security Checks	7/23/2024	7/23/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high