The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0043 advisory.

    Red Hat build of MicroShift is Red Hat's light-weight Kubernetes orchestration solution designed for edge     device deployments and is built from the edge capabilities of Red Hat OpenShift Container Platform.
    MicroShift is an application that is deployed on top of Red Hat Enterprise Linux devices at the edge,     providing an efficient way to operate single-node clusters in these low-resource environments.

    This advisory contains the RPM packages for Red Hat build of MicroShift 4.16.0. Read the following     advisory for the container images for this release:

    https://access.redhat.com/errata/RHSA-2024:0041

    All Red Hat build of MicroShift 4.16 users are advised to use these updated packages and images when they     are available in the RPM repository.

    Security Fix(es):

    * golang-protobuf: encoding/protojson, internal/encoding/json: infinite     loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON     (CVE-2024-24786)
    * kubernetes: kube-apiserver: bypassing mountable secrets policy imposed by     the ServiceAccount admission plugin (CVE-2024-3177)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the kubernetes package has been released.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1403-1 advisory.

  - A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the     mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init     containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running     with a service account may only reference secrets specified in the service account's secrets field.
    Kubernetes clusters are only affected if the ServiceAccount admission plugin and the     kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and     ephemeral containers with the envFrom field populated. (CVE-2024-3177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-ce2eefc399 advisory.

  - An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive     number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and     CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is     allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an     HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to     be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the     receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header     frames we will process before closing a connection. (CVE-2023-45288)

  - A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the     mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init     containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running     with a service account may only reference secrets specified in the service account's secrets field.
    Kubernetes clusters are only affected if the ServiceAccount admission plugin and the     kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and     ephemeral containers with the envFrom field populated. (CVE-2024-3177)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1404-1 advisory.

  - A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the     mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init     containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running     with a service account may only reference secrets specified in the service account's secrets field.
    Kubernetes clusters are only affected if the ServiceAccount admission plugin and the     kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and     ephemeral containers with the envFrom field populated. (CVE-2024-3177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-662a8b6005 advisory.

  - A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the     mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init     containers, and ephemeral containers with the envFrom field populated. The policy ensures pods running     with a service account may only reference secrets specified in the service account's secrets field.
    Kubernetes clusters are only affected if the ServiceAccount admission plugin and the     kubernetes.io/enforce-mountable-secrets annotation are used together with containers, init containers, and     ephemeral containers with the envFrom field populated. (CVE-2024-3177)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
201095	RHEL 9 : Red Hat build of MicroShift 4.16.0 (RHSA-2024:0043)	Nessus	Red Hat Local Security Checks	6/27/2024	6/27/2024	low
204158	Photon OS 4.0: Kubernetes PHSA-2024-4.0-0598	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	low
204141	Photon OS 5.0: Kubernetes PHSA-2024-5.0-0255	Nessus	PhotonOS Local Security Checks	7/24/2024	7/24/2024	low
193807	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.24 (SUSE-SU-2024:1403-1)	Nessus	SuSE Local Security Checks	4/24/2024	4/24/2024	low
194505	Fedora 40 : kubernetes (2024-ce2eefc399)	Nessus	Fedora Local Security Checks	4/29/2024	4/29/2024	low
193766	SUSE SLES15 / openSUSE 15 Security Update : kubernetes1.23 (SUSE-SU-2024:1404-1)	Nessus	SuSE Local Security Checks	4/24/2024	4/24/2024	low
193862	Fedora 39 : kubernetes (2024-662a8b6005)	Nessus	Fedora Local Security Checks	4/25/2024	4/25/2024	low

Detections

Analytics

Plugins Search

low

low

low

low

low

low

low