The vulnerability of the KUBE-APISERVER component of the Kubernetes cluster management software allows a hacker to execute containers bypassing security policies.

🗓️ 27 May 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Kubernetes API server vulnerability enables container execution bypassing policies via envFrom.

Reporter	Title	Published	Views	Family All 125
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security restrictions bypass in Kubernetes kube-apiserver [ CVE-2024-3177]	1 Aug 202416:16	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple vulnerabilities	31 Jul 202514:21	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM CloudPak for AIOps	26 Mar 202503:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Network Automation 2.7.4 addresses multiple security vulnerabilities	15 Apr 202502:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2024-3177)	29 Apr 202409:37	–	ibm
CBLMariner	CVE-2024-3177 affecting package kubernetes for versions less than 1.30.1-1	21 Jun 202409:32	–	cbl_mariner
Chainguard	CVE-2024-3177 vulnerabilities	22 Apr 202423:15	–	cgr
Circl	CVE-2024-3177	23 Feb 202614:54	–	circl
CNNVD	Kubernetes 输入验证错误漏洞	22 Apr 202400:00	–	cnnvd
CNVD	Kubernetes Input Validation Error Vulnerability	25 Apr 202400:00	–	cnvd

Source	Link
github	www.github.com/kubernetes/kubernetes/issues/124336
groups	www.groups.google.com/g/kubernetes-security-announce/c/JxjHf7fkVd8/m/oVCzypyOAQAJ
redos	www.redos.red-soft.ru/support/secure/
web	www.web.nvd.nist.gov/view/vuln/detail

27 May 2024 00:00Current

5.9Medium risk

Vulners AI Score5.9

CVSS 32.7

CVSS 23.3

EPSS0.02224

Kubernetes server vulnerability security policy bypass envFrom exposure