Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade k3s | Aug 22, 2024 | Jul 3, 2023 |
| Debian | — | Upgrade kubernetes | Jul 30, 2024 | Jul 3, 2023 |
| Kubernetes | — | Upgrade Kubernetes to version 1.27.3Upgrade Kubernetes to version 1.25.11Upgrade Kubernetes to version 1.26.6Upgrade Kubernetes to version 1.24.15 | Jul 14, 2023 | Jul 3, 2023 |
| Oracle_linux | — | Upgrade kubeletUpgrade olcne-istio-chartUpgrade olcne-olm-chartUpgrade olcne-metallb-chartUpgrade kubeadmUpgrade olcne-api-serverUpgrade olcne-gluster-chartUpgrade olcne-agentUpgrade olcne-oci-ccm-chartUpgrade olcne-utilsUpgrade olcne-grafana-chartUpgrade olcne-multus-chartUpgrade olcne-extra-modulesUpgrade kubectlUpgrade olcne-rook-chartUpgrade olcne-kubevirt-chartUpgrade olcne-nginxUpgrade olcnectlUpgrade olcne-calico-chartUpgrade yqUpgrade olcne-prometheus-chart | May 21, 2024 | Jul 3, 2023 |
| Redhat Openshift | — | Upgrade python-oslo-middlewareUpgrade python-oslo-serviceUpgrade python-oslo-dbUpgrade python-tenacityUpgrade container-selinuxUpgrade python-oslo-i18nUpgrade python-oslo-utilsUpgrade python-oslo-cacheUpgrade openshift-ansibleUpgrade python-proliantutilsUpgrade catchUpgrade kernelUpgrade spdlogUpgrade python-swiftclientUpgrade python-oslo-policyUpgrade python-glanceclientUpgrade python-stevedoreUpgrade python-cliffUpgrade haproxyUpgrade nmstateUpgrade python-hardwareUpgrade python-oslo-messagingUpgrade python-openstacksdkUpgrade kernel-rtUpgrade python-requestsexceptionsUpgrade cri-oUpgrade python-decoratorUpgrade python-os-service-typesUpgrade butaneUpgrade python-oslo-rootwrapUpgrade kata-containersUpgrade golang-github-prometheus-promuUpgrade google-benchmarkUpgrade python-keystoneauth1Upgrade conmonUpgrade python-pbrUpgrade cri-toolsUpgrade fmtUpgrade python-keystoneclientUpgrade python-oslo-upgradecheckUpgrade toolboxUpgrade openstack-ironicUpgrade python-sushyUpgrade containers-commonUpgrade ignitionUpgrade runcUpgrade python-debtcollectorUpgrade gtestUpgrade openshift4-aws-isoUpgrade openshift-kuryrUpgrade python-ironic-prometheus-exporterUpgrade openstack-ironic-inspectorUpgrade containernetworking-pluginsUpgrade wasmedgeUpgrade openstack-ironic-python-agentUpgrade python-oslo-contextUpgrade python-oslo-versionedobjectsUpgrade crun-wasmUpgrade python-cinderclientUpgrade python-wraptUpgrade openshiftUpgrade podmanUpgrade python-sushy-oem-idracUpgrade python-osc-libUpgrade python-osprofilerUpgrade python-ironic-libUpgrade ovn23.09Upgrade python-toozUpgrade microshiftUpgrade python-pycadfUpgrade skopeoUpgrade python-os-traitsUpgrade buildahUpgrade python-oslo-configUpgrade python-futuristUpgrade crunUpgrade python-keystonemiddlewareUpgrade python-oslo-serializationUpgrade python-dracclientUpgrade python-automatonUpgrade openshift-clientsUpgrade python-oslo-logUpgrade rust-afterburnUpgrade python-scciclientUpgrade coreos-installerUpgrade python-fixturesUpgrade python-oslo-concurrency | Nov 1, 2023 | Jun 15, 2023 |
| Suse | — | Upgrade kubernetes1.23-apiserverUpgrade kubernetes1.23-kubelet-commonUpgrade kubernetes1.24-kubelet-commonUpgrade kubernetes1.24-client-bash-completionUpgrade kubernetes1.23-clientUpgrade kubernetes1.23-kubeadmUpgrade kubernetes1.23-client-commonUpgrade kubernetes1.24-proxyUpgrade kubernetes1.23-kubeletUpgrade kubernetes1.18-clientUpgrade kubernetes1.24-clientUpgrade kubernetes1.23-proxyUpgrade kubernetes1.18-client-commonUpgrade kubernetes1.23-client-bash-completionUpgrade kubernetes1.24-controller-managerUpgrade kubernetes1.23-schedulerUpgrade kubernetes1.24-client-fish-completionUpgrade kubernetes1.24-schedulerUpgrade kubernetes1.23-controller-managerUpgrade kubernetes1.24-apiserverUpgrade kubernetes1.23-client-fish-completionUpgrade kubernetes1.24-kubeletUpgrade kubernetes1.24-client-commonUpgrade kubernetes1.24-kubeadm | Jun 20, 2023 | Jun 19, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub