All errata/p10/ALT-PU-2023-4397-4
ALT-PU-2023-4397-4

Package update kubernetes in branch p10

Version1.26.6-alt1
Task#324828
Published2026-02-04
Max severityMEDIUM
Severity:

Closed issues (8)

BDU:2023-03213
MEDIUM6.5

Уязвимость программного средства управления кластерами виртуальных машин Kubernetes, связанная с возможностью обхода политик модуля допуска ImagePolicyWebhook, позволяющая нарушителю обойти существующие ограничения безопасности при запуске контейнеров

Published: 2023-06-19Modified: 2025-03-05
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0HIGH 7.7
CVSS:2.0/AV:N/AC:L/Au:M/C:C/I:C/A:N
References
BDU:2023-03899
LOW3.4

Уязвимость утилиты kubelet программного средства управления кластерами виртуальных машин Kubernetes, позволяющая нарушителю настроить определенные модули на работу в "неорганиченном режиме"

Published: 2023-07-20Modified: 2025-03-05
CVSS 3.xLOW 3.4
CVSS:3.x/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0LOW 2.9
CVSS:2.0/AV:L/AC:L/Au:M/C:P/I:P/A:N
References
CVE-2023-2431
MEDIUM5.5

A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet.

Published: 2023-06-16Modified: 2024-12-12
CVSS 3.xMEDIUM 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
References
CVE-2023-2727
MEDIUM6.5

Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.

Published: 2023-07-03Modified: 2025-02-13
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
CVE-2023-2728
MEDIUM6.5

Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.

Published: 2023-07-03Modified: 2025-02-13
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
GHSA-cgcv-5272-97pr
MEDIUM6.5

Kubernetes mountable secrets policy bypass

Published: 2023-07-04Modified: 2025-02-13
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
GHSA-qc2g-gmh6-95p4
MEDIUM6.5

kube-apiserver vulnerable to policy bypass

Published: 2023-07-04Modified: 2025-02-13
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
References
GHSA-xc8m-28vv-4pjc
MEDIUM4.4

Kubelet vulnerable to bypass of seccomp profile enforcement

Published: 2023-06-16Modified: 2024-12-12
CVSS 3.xMEDIUM 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
References