GHSA-hq6q-c2x6-hmch
Kubernetes Improper Input Validation vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2023-5528
- Alias
- GO-2023-2341
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes.
Paquets affectés
| Paquet | Versions |
|---|---|
| Go · k8s.io/kubernetes | introduced 1.28.0, fixed 1.28.4 |
| Go · k8s.io/kubernetes | introduced 1.27.0, fixed 1.27.8 |
| Go · k8s.io/kubernetes | introduced 1.26.0, fixed 1.26.11 |
| Go · k8s.io/kubernetes | introduced 0, fixed 1.25.16 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2023-5528 ADVISORY
- https://github.com/kubernetes/kubernetes/issues/121879 WEB
- https://github.com/kubernetes/kubernetes/pull/121881 WEB
- https://github.com/kubernetes/kubernetes/pull/121882 WEB
- https://github.com/kubernetes/kubernetes/pull/121883 WEB
- https://github.com/kubernetes/kubernetes/pull/121884 WEB
- https://github.com/kubernetes/kubernetes/pull/121885 WEB
- https://github.com/kubernetes/kubernetes PACKAGE
- https://groups.google.com/g/kubernetes-security-announce/c/SL_d4NR8pzA WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JH444PWZBINXLLFV7XLIJIZJHSK6UEZ WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4XZIX727JIKF5RQW7RVVBLWXBCDIBJA7 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7MPGMITSZXUCAVO7Q75675SOLXC2XXU4 WEB
- https://security.netapp.com/advisory/ntap-20240119-0009 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |