SUSE update for kubernetes1.24
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2023-2727 CVE-2023-2728 |
| CWE-ID | CWE-264 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #2 is available. |
| Vulnerable software |
Containers Module Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system SUSE Linux Enterprise High Performance Computing 15 Operating systems & Components / Operating system openSUSE Leap Operating systems & Components / Operating system kubernetes1.24-client-fish-completion Operating systems & Components / Operating system package or component kubernetes1.24-client-bash-completion Operating systems & Components / Operating system package or component kubernetes1.24-proxy Operating systems & Components / Operating system package or component kubernetes1.24-kubelet Operating systems & Components / Operating system package or component kubernetes1.24-apiserver Operating systems & Components / Operating system package or component kubernetes1.24-controller-manager Operating systems & Components / Operating system package or component kubernetes1.24-client-common Operating systems & Components / Operating system package or component kubernetes1.24-kubeadm Operating systems & Components / Operating system package or component kubernetes1.24-scheduler Operating systems & Components / Operating system package or component kubernetes1.24-client Operating systems & Components / Operating system package or component kubernetes1.24-kubelet-common Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU77525
Risk: Medium
CVSSv4.0: 6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-2727
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to improperly imposed security restrictions. A remote user can launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers.
Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers.
Update the affected package kubernetes1.24 to the latest version.
Vulnerable software versionsContainers Module: 15-SP5
SUSE Linux Enterprise Server for SAP Applications 15: SP5
SUSE Linux Enterprise Server 15: SP5
SUSE Linux Enterprise Real Time 15: SP5
SUSE Linux Enterprise High Performance Computing 15: SP5
openSUSE Leap: 15.5
kubernetes1.24-client-fish-completion: before 1.24.13-150500.3.3.1
kubernetes1.24-client-bash-completion: before 1.24.13-150500.3.3.1
kubernetes1.24-proxy: before 1.24.13-150500.3.3.1
kubernetes1.24-kubelet: before 1.24.13-150500.3.3.1
kubernetes1.24-apiserver: before 1.24.13-150500.3.3.1
kubernetes1.24-controller-manager: before 1.24.13-150500.3.3.1
kubernetes1.24-client-common: before 1.24.13-150500.3.3.1
kubernetes1.24-kubeadm: before 1.24.13-150500.3.3.1
kubernetes1.24-scheduler: before 1.24.13-150500.3.3.1
kubernetes1.24-client: before 1.24.13-150500.3.3.1
kubernetes1.24-kubelet-common: before 1.24.13-150500.3.3.1
CPE2.3- cpe:2.3:o:suse:containers_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:kubernetes1.24-client-fish-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-client-bash-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-proxy:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-kubelet:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-apiserver:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-controller-manager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-client-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-kubeadm:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-scheduler:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-kubelet-common:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2023/suse-su-20232544-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Permissions, Privileges, and Access Controls
EUVDB-ID: #VU77526
Risk: Medium
CVSSv4.0: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Green]
CVE-ID: CVE-2023-2728
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: Yes
DescriptionThe vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to improperly imposed security restrictions. A remote user can launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers.Kubernetes clusters are only affected if the ServiceAccount admission plugin and the kubernetes.io/enforce-mountable-secrets annotation are used together with ephemeral containers.
Update the affected package kubernetes1.24 to the latest version.
Vulnerable software versionsContainers Module: 15-SP5
SUSE Linux Enterprise Server for SAP Applications 15: SP5
SUSE Linux Enterprise Server 15: SP5
SUSE Linux Enterprise Real Time 15: SP5
SUSE Linux Enterprise High Performance Computing 15: SP5
openSUSE Leap: 15.5
kubernetes1.24-client-fish-completion: before 1.24.13-150500.3.3.1
kubernetes1.24-client-bash-completion: before 1.24.13-150500.3.3.1
kubernetes1.24-proxy: before 1.24.13-150500.3.3.1
kubernetes1.24-kubelet: before 1.24.13-150500.3.3.1
kubernetes1.24-apiserver: before 1.24.13-150500.3.3.1
kubernetes1.24-controller-manager: before 1.24.13-150500.3.3.1
kubernetes1.24-client-common: before 1.24.13-150500.3.3.1
kubernetes1.24-kubeadm: before 1.24.13-150500.3.3.1
kubernetes1.24-scheduler: before 1.24.13-150500.3.3.1
kubernetes1.24-client: before 1.24.13-150500.3.3.1
kubernetes1.24-kubelet-common: before 1.24.13-150500.3.3.1
CPE2.3- cpe:2.3:o:suse:containers_module:15-SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_high_performance_computing_15:SP5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:opensuse_leap:15.5:*:*:*:*:*:*:*
- cpe:2.3:o:suse:kubernetes1.24-client-fish-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-client-bash-completion:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-proxy:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-kubelet:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-apiserver:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-controller-manager:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-client-common:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-kubeadm:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-scheduler:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-client:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:o:suse:kubernetes1.24-kubelet-common:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2023/suse-su-20232544-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
