Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account’s secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade k3s | Aug 22, 2024 | Jul 3, 2023 |
| Debian | — | Upgrade kubernetes | Jul 30, 2024 | Jul 3, 2023 |
| Kubernetes | — | Upgrade Kubernetes to version 1.27.3Upgrade Kubernetes to version 1.24.15Upgrade Kubernetes to version 1.25.11Upgrade Kubernetes to version 1.26.6 | Jul 14, 2023 | Jul 3, 2023 |
| Oracle_linux | — | oracle-linux-upgrade-kubeadmoracle-linux-upgrade-kubectloracle-linux-upgrade-kubeletoracle-linux-upgrade-olcne-agentoracle-linux-upgrade-olcne-api-serveroracle-linux-upgrade-olcne-calico-chartoracle-linux-upgrade-olcnectloracle-linux-upgrade-olcne-extra-modulesoracle-linux-upgrade-olcne-gluster-chartoracle-linux-upgrade-olcne-grafana-chartoracle-linux-upgrade-olcne-istio-chartoracle-linux-upgrade-olcne-kubevirt-chartoracle-linux-upgrade-olcne-metallb-chartoracle-linux-upgrade-olcne-multus-chartoracle-linux-upgrade-olcne-nginxoracle-linux-upgrade-olcne-oci-ccm-chartoracle-linux-upgrade-olcne-olm-chartoracle-linux-upgrade-olcne-prometheus-chartoracle-linux-upgrade-olcne-rook-chartoracle-linux-upgrade-olcne-utilsoracle-linux-upgrade-yq | May 21, 2024 | Jul 3, 2023 |
| Redhat Openshift | — | Upgrade python-oslo-serializationUpgrade openstack-ironic-inspectorUpgrade python-pycadfUpgrade crun-wasmUpgrade coreos-installerUpgrade python-futuristUpgrade skopeoUpgrade python-fixturesUpgrade python-osprofilerUpgrade openshift4-aws-isoUpgrade openshift-clientsUpgrade python-oslo-logUpgrade python-ironic-prometheus-exporterUpgrade crunUpgrade python-os-traitsUpgrade wasmedgeUpgrade rust-afterburnUpgrade python-automatonUpgrade python-osc-libUpgrade containernetworking-pluginsUpgrade python-oslo-concurrencyUpgrade python-ironic-libUpgrade openshiftUpgrade gtestUpgrade python-scciclientUpgrade python-cinderclientUpgrade python-wraptUpgrade python-sushyUpgrade openshift-kuryrUpgrade ovn23.09Upgrade ignitionUpgrade kata-containersUpgrade python-openstacksdkUpgrade python-oslo-configUpgrade python-cliffUpgrade runcUpgrade spdlogUpgrade openstack-ironic-python-agentUpgrade python-oslo-policyUpgrade python-sushy-oem-idracUpgrade buildahUpgrade python-toozUpgrade nmstateUpgrade python-oslo-dbUpgrade python-dracclientUpgrade butaneUpgrade python-oslo-versionedobjectsUpgrade openstack-ironicUpgrade cri-toolsUpgrade python-keystoneclientUpgrade kernel-rtUpgrade python-oslo-serviceUpgrade python-tenacityUpgrade kernelUpgrade openshift-ansibleUpgrade fmtUpgrade python-oslo-upgradecheckUpgrade haproxyUpgrade microshiftUpgrade python-oslo-messagingUpgrade python-decoratorUpgrade python-oslo-rootwrapUpgrade python-debtcollectorUpgrade conmonUpgrade python-requestsexceptionsUpgrade golang-github-prometheus-promuUpgrade python-oslo-utilsUpgrade python-oslo-i18nUpgrade python-keystoneauth1Upgrade python-proliantutilsUpgrade python-hardwareUpgrade python-stevedoreUpgrade container-selinuxUpgrade python-pbrUpgrade podmanUpgrade cri-oUpgrade containers-commonUpgrade python-oslo-middlewareUpgrade python-keystonemiddlewareUpgrade catchUpgrade toolboxUpgrade python-os-service-typesUpgrade python-swiftclientUpgrade python-oslo-cacheUpgrade google-benchmarkUpgrade python-glanceclientUpgrade python-oslo-context | Nov 1, 2023 | Jul 3, 2023 |
| Suse | — | suse-upgrade-kubernetes1-18-clientsuse-upgrade-kubernetes1-18-client-commonsuse-upgrade-kubernetes1-23-apiserversuse-upgrade-kubernetes1-23-clientsuse-upgrade-kubernetes1-23-client-bash-completionsuse-upgrade-kubernetes1-23-client-commonsuse-upgrade-kubernetes1-23-client-fish-completionsuse-upgrade-kubernetes1-23-controller-managersuse-upgrade-kubernetes1-23-kubeadmsuse-upgrade-kubernetes1-23-kubeletsuse-upgrade-kubernetes1-23-kubelet-commonsuse-upgrade-kubernetes1-23-proxysuse-upgrade-kubernetes1-23-schedulersuse-upgrade-kubernetes1-24-apiserversuse-upgrade-kubernetes1-24-clientsuse-upgrade-kubernetes1-24-client-bash-completionsuse-upgrade-kubernetes1-24-client-commonsuse-upgrade-kubernetes1-24-client-fish-completionsuse-upgrade-kubernetes1-24-controller-managersuse-upgrade-kubernetes1-24-kubeadmsuse-upgrade-kubernetes1-24-kubeletsuse-upgrade-kubernetes1-24-kubelet-commonsuse-upgrade-kubernetes1-24-proxysuse-upgrade-kubernetes1-24-scheduler | Jun 20, 2023 | Jun 19, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 3, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub