Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade kubernetes | Jul 30, 2024 | Mar 1, 2023 |
| Kubernetes | — | Upgrade Kubernetes to version 1.25.4Upgrade Kubernetes to version 1.22.16Upgrade Kubernetes to version 1.24.8Upgrade Kubernetes to version 1.23.14 | Mar 13, 2023 | Mar 1, 2023 |
| Oracle_linux | — | Upgrade olcne-istio-chartUpgrade olcne-agentUpgrade olcne-gluster-chartUpgrade olcne-oci-ccm-chartUpgrade olcne-olm-chartUpgrade olcne-utilsUpgrade kubectlUpgrade olcne-metallb-chartUpgrade olcne-api-serverUpgrade kubeadmUpgrade olcne-oci-csi-chartUpgrade olcne-grafana-chartUpgrade olcnectlUpgrade olcne-prometheus-chartUpgrade olcne-nginxUpgrade kubelet | Mar 1, 2023 | Mar 1, 2023 |
| Redhat Openshift | — | Upgrade openshiftUpgrade microshift | Jan 18, 2023 | Nov 10, 2022 |
| Suse | — | Upgrade kubernetes1.24-clientUpgrade kubernetes1.24-client-commonUpgrade kubernetes1.23-clientUpgrade kubernetes1.23-client-common | May 29, 2023 | Mar 1, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Mar 1, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub