An authentication bypass vulnerability was discovered in kube-apiserver. This issue could allow a remote, authenticated attacker who has been given permissions "update, patch" the "pods/ephemeralcontainers" subresource beyond what the default is. They would then need to create a new pod or patch one that they already have access to. This might allow evasion of SCC admission restrictions, thereby gaining control of a privileged pod.
References
Link | Resource |
---|---|
https://access.redhat.com/errata/RHSA-2023:3976 | Third Party Advisory |
https://access.redhat.com/errata/RHSA-2023:4093 | Third Party Advisory |
https://access.redhat.com/errata/RHSA-2023:4312 | Third Party Advisory |
https://access.redhat.com/errata/RHSA-2023:4898 | Third Party Advisory |
https://access.redhat.com/security/cve/CVE-2023-1260 | Third Party Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=2176267 | Issue Tracking Third Party Advisory |
https://security.netapp.com/advisory/ntap-20231020-0010/ | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
History
15 Dec 2023, 18:19
Type | Values Removed | Values Added |
---|---|---|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.0 |
16 Nov 2023, 00:56
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) https://security.netapp.com/advisory/ntap-20231020-0010/ - Third Party Advisory |
20 Oct 2023, 15:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
26 Sep 2023, 16:21
Type | Values Removed | Values Added |
---|---|---|
CWE | NVD-CWE-Other | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.1 |
First Time |
Kubernetes
Redhat openshift Container Platform Redhat Kubernetes kube-apiserver |
|
CPE | cpe:2.3:a:kubernetes:kube-apiserver:-:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.11:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.13:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.12:*:*:*:*:*:*:* cpe:2.3:a:redhat:openshift_container_platform:4.10:*:*:*:*:*:*:* |
|
References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2176267 - Issue Tracking, Third Party Advisory | |
References | (MISC) https://access.redhat.com/errata/RHSA-2023:4312 - Third Party Advisory | |
References | (MISC) https://access.redhat.com/errata/RHSA-2023:4093 - Third Party Advisory | |
References | (MISC) https://access.redhat.com/security/cve/CVE-2023-1260 - Third Party Advisory | |
References | (MISC) https://access.redhat.com/errata/RHSA-2023:4898 - Third Party Advisory | |
References | (MISC) https://access.redhat.com/errata/RHSA-2023:3976 - Third Party Advisory |
24 Sep 2023, 01:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-09-24 01:15
Updated : 2023-12-15 18:19
NVD link : CVE-2023-1260
Mitre link : CVE-2023-1260
CVE.ORG link : CVE-2023-1260
JSON object : View
Products Affected
kubernetes
- kube-apiserver
redhat
- openshift_container_platform
CWE