An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
21 Nov 2024, 07:38
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://access.redhat.com/errata/RHSA-2023:3976 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:4093 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:4312 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:4898 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2023:5008 - | |
| References | () https://access.redhat.com/security/cve/CVE-2023-1260 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2176267 - Issue Tracking, Third Party Advisory | |
| References | () https://github.com/advisories/GHSA-92hx-3mh6-hc49 - | |
| References | () https://security.netapp.com/advisory/ntap-20231020-0010/ - Third Party Advisory |
03 May 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
15 Dec 2023, 18:19
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-24 01:15
Updated : 2024-11-21 07:38
NVD link : CVE-2023-1260
Mitre link : CVE-2023-1260
CVE.ORG link : CVE-2023-1260
JSON object : View
Products Affected
redhat
- openshift_container_platform
kubernetes
- kube-apiserver
CWE