The grc-policy-propagator allows security escalation within the cluster. The propagator allows policies which contain some dynamically obtained values (instead of the policy apply a static manifest on a managed cluster) of taking advantage of cluster scoped access in a created policy. This feature does not restrict properly to lookup content from the namespace where the policy was created.
References
| Link | Resource |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=2211468#c0 | Issue Tracking Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Jun 2023, 16:02
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| CWE | CWE-269 | |
| First Time |
Redhat advanced Cluster Management For Kubernetes
Redhat |
|
| CPE | cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.5:*:*:*:*:*:*:* cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.6:*:*:*:*:*:*:* cpe:2.3:a:redhat:advanced_cluster_management_for_kubernetes:2.7:*:*:*:*:*:*:* |
|
| References | (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2211468#c0 - Issue Tracking, Vendor Advisory |
05 Jun 2023, 22:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-05 22:15
Updated : 2023-12-10 15:01
NVD link : CVE-2023-3027
Mitre link : CVE-2023-3027
CVE.ORG link : CVE-2023-3027
JSON object : View
Products Affected
redhat
- advanced_cluster_management_for_kubernetes
CWE
CWE-269
Improper Privilege Management