An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
References
Link | Resource |
---|---|
https://access.redhat.com/errata/RHSA-2023:3976 | Third Party Advisory |
https://access.redhat.com/errata/RHSA-2023:4093 | Third Party Advisory |
https://access.redhat.com/errata/RHSA-2023:4312 | Third Party Advisory |
https://access.redhat.com/errata/RHSA-2023:4898 | Third Party Advisory |
https://access.redhat.com/errata/RHSA-2023:5008 | |
https://access.redhat.com/security/cve/CVE-2023-1260 | Third Party Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=2176267 | Issue Tracking Third Party Advisory |
https://github.com/advisories/GHSA-92hx-3mh6-hc49 | |
https://security.netapp.com/advisory/ntap-20231020-0010/ | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: redhat
Published: 2023-09-24T00:07:08.130Z
Updated: 2024-05-03T15:32:33.416Z
Reserved: 2023-03-07T20:12:18.360Z
Link: CVE-2023-1260
JSON object: View
NVD Information
Status : Modified
Published: 2023-09-24T01:15:42.707
Modified: 2024-05-03T16:15:10.330
Link: CVE-2023-1260
JSON object: View
Redhat Information
No data.
CWE