Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade k3s | Aug 22, 2024 | Jul 3, 2023 |
| Debian | — | Upgrade kubernetes | Jul 30, 2024 | Jul 3, 2023 |
| Kubernetes | — | Upgrade Kubernetes to version 1.27.3Upgrade Kubernetes to version 1.26.6Upgrade Kubernetes to version 1.25.11Upgrade Kubernetes to version 1.24.15 | Jul 14, 2023 | Jul 3, 2023 |
| Oracle_linux | — | Upgrade olcne-utilsUpgrade olcne-extra-modulesUpgrade olcne-oci-ccm-chartUpgrade olcne-grafana-chartUpgrade olcne-metallb-chartUpgrade olcne-multus-chartUpgrade kubectlUpgrade olcne-api-serverUpgrade kubeadmUpgrade olcne-gluster-chartUpgrade kubeletUpgrade olcne-istio-chartUpgrade olcne-olm-chartUpgrade olcne-agentUpgrade olcne-nginxUpgrade olcne-prometheus-chartUpgrade olcne-calico-chartUpgrade yqUpgrade olcne-rook-chartUpgrade olcnectlUpgrade olcne-kubevirt-chart | May 21, 2024 | Jul 3, 2023 |
| Redhat Openshift | — | Upgrade python-oslo-logUpgrade python-fixturesUpgrade podmanUpgrade python-cinderclientUpgrade coreos-installerUpgrade openshift-kuryrUpgrade containernetworking-pluginsUpgrade python-oslo-serializationUpgrade openshift4-aws-isoUpgrade python-futuristUpgrade microshiftUpgrade python-automatonUpgrade python-osc-libUpgrade rust-afterburnUpgrade crunUpgrade python-oslo-concurrencyUpgrade python-oslo-versionedobjectsUpgrade openshiftUpgrade crun-wasmUpgrade python-scciclientUpgrade ovn23.09Upgrade python-keystonemiddlewareUpgrade python-sushy-oem-idracUpgrade python-ironic-prometheus-exporterUpgrade python-debtcollectorUpgrade openstack-ironic-python-agentUpgrade python-pycadfUpgrade runcUpgrade python-osprofilerUpgrade python-os-traitsUpgrade python-dracclientUpgrade python-toozUpgrade wasmedgeUpgrade buildahUpgrade python-ironic-libUpgrade skopeoUpgrade python-oslo-configUpgrade python-oslo-contextUpgrade openstack-ironic-inspectorUpgrade python-wraptUpgrade gtestUpgrade openshift-clientsUpgrade python-pbrUpgrade cri-oUpgrade python-requestsexceptionsUpgrade python-hardwareUpgrade butaneUpgrade python-oslo-dbUpgrade kernelUpgrade python-oslo-rootwrapUpgrade python-stevedoreUpgrade container-selinuxUpgrade openshift-ansibleUpgrade python-oslo-utilsUpgrade python-glanceclientUpgrade python-oslo-middlewareUpgrade kernel-rtUpgrade toolboxUpgrade python-cliffUpgrade python-openstacksdkUpgrade kata-containersUpgrade python-keystoneclientUpgrade conmonUpgrade containers-commonUpgrade python-proliantutilsUpgrade google-benchmarkUpgrade python-oslo-upgradecheckUpgrade cri-toolsUpgrade python-keystoneauth1Upgrade python-oslo-cacheUpgrade fmtUpgrade openstack-ironicUpgrade haproxyUpgrade python-swiftclientUpgrade nmstateUpgrade catchUpgrade python-oslo-i18nUpgrade golang-github-prometheus-promuUpgrade python-oslo-messagingUpgrade python-oslo-policyUpgrade python-decoratorUpgrade spdlogUpgrade python-os-service-typesUpgrade ignitionUpgrade python-oslo-serviceUpgrade python-sushyUpgrade python-tenacity | Nov 1, 2023 | Jun 15, 2023 |
| Suse | — | Upgrade kubernetes1.23-client-bash-completionUpgrade kubernetes1.24-clientUpgrade kubernetes1.23-apiserverUpgrade kubernetes1.23-kubeletUpgrade kubernetes1.24-proxyUpgrade kubernetes1.24-kubelet-commonUpgrade kubernetes1.23-proxyUpgrade kubernetes1.18-clientUpgrade kubernetes1.23-client-commonUpgrade kubernetes1.23-kubelet-commonUpgrade kubernetes1.24-client-bash-completionUpgrade kubernetes1.18-client-commonUpgrade kubernetes1.23-clientUpgrade kubernetes1.23-kubeadmUpgrade kubernetes1.24-client-fish-completionUpgrade kubernetes1.23-controller-managerUpgrade kubernetes1.24-apiserverUpgrade kubernetes1.24-client-commonUpgrade kubernetes1.24-kubeletUpgrade kubernetes1.23-schedulerUpgrade kubernetes1.23-client-fish-completionUpgrade kubernetes1.24-kubeadmUpgrade kubernetes1.24-controller-managerUpgrade kubernetes1.24-scheduler | Jun 20, 2023 | Jun 19, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 3, 2023 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub